CVE:CVE-2021-25980
CNNVD:CNNVD-202111-1081
Talkyard是开源的一个结构化的讨论平台，汇集了 StackOverflow、Slack、Discourse、Reddit/HackerNews 和 Disqus 博客评论的主要功能。
Talkyard 存在安全漏洞，未经身份验证的攻击者可以使用forgot password功能重置受害者的密码并成功接管他们的帐户。以下产品及版本受到影响：Talkyard, versions v0.04.01 through v0.6.74-WIP-63220cb, v0.2020.22-WIP-b2e97fe0e through v0.2021.02-WIP-879ef3fe1 and tyse-v0.2021.02-879ef3fe1-regular through tyse-v0.2021.28-af66b6905-regular。
solution:Upgrade talkyard talkyard to a higher version than 0.6.74-wip-63220cb,0.2021.02-wip-879ef3fe1,tyse-v0.2021.28-af66b6905-regular,and avoid the version [0.04.01,0.6.74-wip-63220cb],[0.2020.22-wip-b2e97fe0e,0.2021.02-wip-879ef3fe1],[tyse-v0.2021.02-879ef3fe1-regular,tyse-v0.2021.28-af66b6905-regular]