LiveActive security incident?Get immediate response
CVE Record

CVE-2022-31184: Email activation route can be abused by spammers in Discourse

Discourse is the an open source discussion platform. In affected versions an email activation route can be abused to send mass spam emails. A fix has been included in the latest stable, beta and tests-passed versions of Discourse which rate limits emails. Users are advised to upgrade. Users unable to upgrade should manually rate limit email.

MediumCVSS 6.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

Affected Discourse sites could have their email activation flow abused to generate large volumes of spam email. This is mainly an operational and reputation risk: mail queues, sender reputation, and availability of email service can be harmed. The vendor fixed it by adding email rate limiting.

Executive priority

Prioritize remediation for internet-facing Discourse forums that send email. The risk is not data theft, but abuse can damage email reputation, disrupt account workflows, and create operational cost.

Technical view

CVE-2022-31184 is a CWE-770 improper resource allocation issue in Discourse. Versions before 2.8.7 and before 2.9.0.beta8 lacked sufficient rate limiting on an email activation route, allowing mass email sending. CVSS 3.1 is 6.5 with network access, no privileges, required user interaction, and high availability impact.

Likely exposure

Public Discourse deployments running versions earlier than 2.8.7 or 2.9.0.beta8 are the likely exposure, especially where outbound email is enabled and activation emails can be triggered externally.

Exploitation context

The source bundle says the route can be abused by spammers, but KEV is false and no cited source confirms active exploitation. Treat this as credible abuse potential, not confirmed in-the-wild exploitation.

Researcher notes

Evidence is limited to the CVE record, GitHub advisory, and fix commit. The advisory identifies rate limiting as the fix and manual email rate limiting as the workaround. No exploit details or active exploitation confirmation are provided.

Mitigation direction

  • Upgrade Discourse to 2.8.7, 2.9.0.beta8, or a later vendor-supported release.
  • If upgrade is delayed, manually rate limit activation email sending.
  • Review the GitHub advisory for current vendor guidance before deploying changes.
  • Monitor outbound email volume, bounces, and provider spam complaints.

Validation and detection

  • Inventory Discourse instances and record exact running versions.
  • Confirm exposed instances are not below 2.8.7 or 2.9.0.beta8.
  • Check mail logs for unusual activation email volume or delivery failures.
  • Verify rate limiting exists for activation email workflows.
  • Review sender reputation alerts from the configured email provider.
Prepared
Confidence
high
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-770: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2022-31184 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6.5CVSS 3.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H2.83.6Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

6.5Medium
CVSS 3.1 vector shape for CVE-2022-31184Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
discoursediscourse< 2.8.7, < 2.9.0.beta8Listed
Weakness

CWE details

CWE-770

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-770 · source CWE mapping

Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs