CVE-2023-38685

Katalog CVE

CVSS 4.3 · Medium EPSS 0,47%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada discourse. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, information about restricted-visibility topic tags could be obtained by unauthorized users. The issue is patched in version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches.

Rincian

Terbit di NVD

28 Juli 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

0,47% peluang dieksploitasi; lebih tinggi dari 38,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 212 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• https://github.com/discourse/discourse/security/advisories/GHSA-wx6x-q4gp-mgv5 advisory vendor
• https://github.com/discourse/discourse/commit/073661142369a0a66c25775cc3870582a679ef8b patch