Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2019-1020017

Discourse before 2.3.0 and 2.4.x before 2.4.0.beta3 lacks a confirmation screen when logging in via a user-api OTP.

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
dwf

Description

Discourse before 2.3.0 and 2.4.x before 2.4.0.beta3 lacks a confirmation screen when logging in via a user-api OTP.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

n/a Discourse

  • < 2.3.0affected
  • 2.4.0.beta1affected
  • 2.4.0.beta2affected
  • fixed in 2.4.0.beta3affected

References