title: Anonymous user cache poisoning via development-mode header in Discourse
description: Discourse is an open source discussion platform. In affected versions an attacker can poison the cache for anonymous (i.e. not logged in) users, such that the users are shown a JSON blob instead of the HTML page. This can lead to a partial denial-of-service. This issue is patched in the latest stable, beta and tests-passed versions of Discourse.
problem types: CWE-610: Externally Controlled Reference to a Resource in Another Sphere
affected:
{
product: discourse
vendor: discourse
versions:
status: affected, version: stable < 2.7.11
status: affected, version: beta < 2.8.0.beta9
status: affected, version: tests-passed < 2.8.0.beta9
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
]