Security News > 2021 > October > CISA Urges Sites to Patch Critical RCE in Discourse
Discourse - the ultra-popular, widely deployed open-source community forum and mailing list management platform - has a critical remote code-execution bug that was fixed in an urgent update on Friday.
Discourse is widely used and wildly popular, being known for topping competing forum software platforms in terms of usability.
The issue has been patched in the latest beta, stable and tests-passed versions of Discourse.
The researcher, "Joernchen," told BleepingComputer that he reported the issue to the Discourse team immediately upon finding it on Oct. 10 and that the patch itself made it easy to figure out how an exploit would work.
Although the software-as-a-service versions of Discourse were fixed as of Wednesday, there might still be many vulnerable deployments.
Threatpost has reached out to Discourse for more details and to ask whether or not the team has seen any signs that the RCE has been exploited in the wild.
News URL
https://threatpost.com/cisa-critical-rce-discourse/175705/
Related news
- CISA: Network switch RCE flaw impacts critical infrastructure (source)
- Week in review: Critical Zimbra RCE vulnerability exploited, Patch Tuesday forecast (source)
- CISA says critical Fortinet RCE flaw now exploited in attacks (source)
- VMware fixes bad patch for critical vCenter Server RCE flaw (source)
- Synology Urges Patch for Critical Zero-Click RCE Flaw Affecting Millions of NAS Devices (source)
- Critical 9.8-rated VMware vCenter RCE bug exploited after patch fumble (source)
- 'Patch yesterday': Zimbra mail servers under siege through RCE vuln (source)
- Critical Zimbra RCE vulnerability under mass exploitation (CVE-2024-45519) (source)
- Critical Zimbra RCE flaw exploited to backdoor servers using emails (source)
- Critical Ivanti RCE flaw with public exploit now used in attacks (source)