Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 3.0.0.beta16 on the `beta` and `tests-passed` branches, the number of times a user posted in an arbitrary topic is exposed to unauthorized users through the `/u/username.json` endpoint. The issue is patched in version 2.8.14 and 3.0.0.beta16. There is no known workaround.
Attack Vector Network
Attack Complexity Low
Privileges Required None
Scope Unchanged
Confidentiality Impact Low
Integrity Impact None
Availability Impact None
User Interaction None
No CVSS v3.0
No CVSS v2
| Vendors | Products |
|---|---|
| Discourse |
|
Configuration 1 [-]
|
Configuration 2 [-]
|
References
| Link | Resource |
|---|---|
| https://github.com/discourse/discourse/commit/cbcf8a064b4889a19c991641e09c399bfa1ef2ad | Patch Third Party Advisory |
| https://github.com/discourse/discourse/security/advisories/GHSA-xx97-6494-p2rv | Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: GitHub_M
Published: 2023-01-05T19:53:34.180Z
Updated:
Reserved: 2022-12-29T03:00:40.877Z
Link: CVE-2023-22453
JSON object: View
NVD Information
Status : Analyzed
Published: 2023-01-05T20:15:18.743
Modified: 2023-01-13T15:59:43.257
Link: CVE-2023-22453
JSON object: View
Redhat Information
No data.
CWE