CVE-2021-43794

    Dashboard / Vulnerabilities / CVE-2021-43794

    CVE-2021-43794

    Published: 1 Dec 2021Last Modified: 9 Jul 2026

    Summary:

    Details: Discourse is an open source discussion platform. In affected versions an attacker can poison the cache for anonymous (i.e. not logged in) users, such that the users are shown a JSON blob instead of the HTML page. This can lead to a partial denial-of-service. This issue is patched in the latest stable, beta and tests-passed versions of Discourse.

    References: https://github.com/discourse/discourse/security/advisories/GHSA-249g-pc77-65hp, https://github.com/discourse/discourse/commit/2da0001965c6d8632d723c46ea5df9f22a1a23f1

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -30bc65af7036465001efc8c06b421e5098073538

    Affected versions

    v2.7.10
    v2.7.9
    v2.7.8
    v2.7.7
    v2.7.6
    v2.7.5
    v2.7.4
    v2.7.3
    v2.7.2
    v2.7.1
    v2.7.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-43794 | CVE-DB