CVE-2022-31060: 
NixOS vulnerability analysis and mitigation

Discourse, an open-source discussion platform, was affected by a vulnerability (CVE-2022-31060) where banner topic data was exposed on login-required sites. This vulnerability was present in versions prior to 2.8.4 in the stable branch and version 2.9.0.beta5 in the beta and tests-passed branches. The issue was discovered and disclosed in June 2022 (GitHub Advisory).

The vulnerability allowed banner topic data to be exposed on sites where login was required, potentially revealing sensitive information to unauthenticated users. The issue received a CVSS v3.1 base score of 5.3 (MEDIUM) and a CVSS v2.0 score of 5.0 (MEDIUM), indicating moderate severity (NVD).

The vulnerability could lead to information disclosure on Discourse instances where login was required. Specifically, banner topic content could be accessed by unauthenticated users, potentially exposing sensitive information that should only be available to logged-in users (GitHub Advisory).

The issue was patched in version 2.8.4 of the stable branch and version 2.9.0.beta5 in the beta and tests-passed branches. As a temporary workaround, administrators could disable banners entirely (GitHub Advisory).