Discourse is an open source discussion platform. The embeddable comments can be exploited to create new topics as any user but without any clear title or content. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. As a workaround, disable embeddable comments by deleting all embeddable hosts.
Attack Vector Network
Attack Complexity Low
Privileges Required None
Scope Unchanged
Confidentiality Impact None
Integrity Impact Low
Availability Impact None
User Interaction None
No CVSS v3.0
No CVSS v2
| Vendors | Products |
|---|---|
| Discourse |
|
Configuration 1 [-]
|
Configuration 2 [-]
|
References
| Link | Resource |
|---|---|
| https://github.com/discourse/discourse/security/advisories/GHSA-7mf3-5v84-wxq8 | Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: GitHub_M
Published: 2023-02-03T21:57:29.878Z
Updated:
Reserved: 2023-01-16T17:07:46.242Z
Link: CVE-2023-23615
JSON object: View
NVD Information
Status : Analyzed
Published: 2023-02-03T22:15:12.643
Modified: 2023-02-14T15:46:35.163
Link: CVE-2023-23615
JSON object: View
Redhat Information
No data.
CWE