Skip to content
OpenAdvisories
Medium · 4.3 CVE-2024-24755 EUVD-2024-22147

discourse-group-membership-ip-block is exposing potentially sensitive custom fields

Published Feb 1, 2024 · Updated Aug 1, 2024 · Assigned by GitHub_M

Description

discourse-group-membership-ip-block is a discourse plugin that adds support for adding users to groups based on their IP address. discourse-group-membership-ip-block was sending all group custom fields to the client, including group custom fields from other plugins which may expect their custom fields to remain secret.

Affected products

VendorProductAffectedFixed
discourse discourse-group-membership-ip-block < b394d61b0bdfd18a2d8310aa5cf26cccf8bd31c1 —

References