CVE-2019-1020017 Discourse before 2.3.0 and 2.4.x before 2.4.0.beta3 lacks a confirmation screen when logging in via a user-api OTP

Description

Discourse before 2.3.0 and 2.4.x before 2.4.0.beta3 lacks a confirmation screen when logging in via a user-api OTP.

Affected products and versions

Product	Affected versions	Fixed in
Discourse 2.4	2.4.0.beta1 → 2.4.0.beta2	No fix stated
Discourse 2.3	earliest → < 2.3.0	2.3.0

Other CVEs of Discourse

The 2 CVEs of Discourse →

CVE-2019-1020018 Discourse before 2.3.0 and 2.4.x before 2.4.0.beta3 lacks a confirmation screen when logging in via an email link Not rated