MEDIUM🇵🇱 Wersja polska

CVE-2025-61598

CVSS 6.3v4.0pub. 2025-10-28upd. 2025-12-03

Discourse is an open source discussion platform. Version before 3.6.2 and 3.6.0.beta2, default Cache-Control response header with value no-store, no-cache was missing from error responses. This may caused unintended caching of those responses by proxies potentially leading to cache poisoning attacks. This vulnerability is fixed in 3.6.2 and 3.6.0.beta2.

CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Discourse

    APP
    Discourse
    3.6.0< 3.5.2< 3.6.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2022-36066CRITICAL9.1ten sam produkt

Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior t...

CVE-2021-41163CRITICAL10.0ten sam produkt

Discourse is an open source platform for community discussion. In affected versions maliciously crafted reques...

CVE-2026-29072HIGH8.2ten sam produkt

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, ...

CVE-2026-27934HIGH8.7ten sam produkt

Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 h...

CVE-2026-26078HIGH7.5ten sam produkt

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, when the...