Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and 3.1.0.beta2 on the `beta` and `tests-passed` branches, the contents of latest/top routes for restricted tags can be accessed by unauthorized users. This issue is patched in version 3.0.1 on the `stable` branch and 3.1.0.beta2 on the `beta` and `tests-passed` branches. There are no known workarounds.
Attack Vector Network
Attack Complexity Low
Privileges Required None
Scope Unchanged
Confidentiality Impact Low
Integrity Impact None
Availability Impact None
User Interaction None
No CVSS v3.0
No CVSS v2
| Vendors | Products |
|---|---|
| Discourse |
|
Configuration 1 [-]
|
Configuration 2 [-]
|
References
| Link | Resource |
|---|---|
| https://github.com/discourse/discourse/commit/105fee978d73b0ec23ff814a09d1c0c9ace95164 | Patch Third Party Advisory |
| https://github.com/discourse/discourse/pull/20004 | Patch Third Party Advisory |
| https://github.com/discourse/discourse/security/advisories/GHSA-hvj9-g84x-5prx | Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: GitHub_M
Published: 2023-01-27T00:00:00
Updated: 2023-01-27T00:00:00
Reserved: 2023-01-16T00:00:00
Link: CVE-2023-23620
JSON object: View
NVD Information
Status : Analyzed
Published: 2023-01-28T00:15:09.270
Modified: 2023-02-14T14:44:35.343
Link: CVE-2023-23620
JSON object: View
Redhat Information
No data.
CWE