CVE-2023-23622

Katalog CVE

CVSS 4.3 · Medium EPSS 0,53%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada discourse. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

Discourse is an open-source discussion platform. Prior to version 3.0.1 of the `stable` branch and version 3.1.0.beta2 of the `beta` and `tests-passed` branches, the count of topics displayed for a tag is a count of all regular topics regardless of whether the topic is in a read restricted category or not. As a result, any users can technically poll a sensitive tag to determine if a new topic is created in a category which the user does not have excess to. In version 3.0.1 of the `stable` branch and version 3.1.0.beta2 of the `beta` and `tests-passed` branches, the count of topics displayed for a tag defaults to only counting regular topics which are not in read restricted categories. Staff users will continue to see a count of all topics regardless of the topic's category read restrictions.

Rincian

Terbit di NVD

17 Maret 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

0,53% peluang dieksploitasi; lebih tinggi dari 43,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 207 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• https://github.com/discourse/discourse/security/advisories/GHSA-2wvr-4x7w-v795 advisory vendor
• https://github.com/discourse/discourse/commit/105fee978d73b0ec23ff814a09d1c0c9ace95164 patch
• https://github.com/discourse/discourse/commit/ecb9aa5dba94741d9579f4f873f0675f48b4184f patch
• https://github.com/discourse/discourse/pull/20004 issue tracking · patch
• https://github.com/discourse/discourse/pull/20005 issue tracking