PT-2023-12729 · Discourse · Discourse

Gregxsunday · Publicado 2023-01-05 · Atualizado 2024-03-06 · CVE-2022-23546

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Discourse version 2.9.0.beta14

Description The issue in Discourse, an open-source discussion platform, involves maliciously embedded URLs that can leak an admin's digest of recent topics, potentially exposing private information. A patch is available to address this issue.

Recommendations For version 2.9.0.beta14, update to version 2.9.0.beta15 to resolve the issue. At the moment, there is no information about other workarounds for this issue.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BIT-DISCOURSE-2022-23546

CVE-2022-23546

GHSA-Q9JP-XV4G-328F

Produtos afetados

Discourse

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23546.json · Exploit
• https://github.com/discourse/discourse/security/advisories/GHSA-q9jp-xv4g-328f · Nota
• https://github.com/discourse/discourse/commit/cf862e736565c6fa905c12b5dbe63d0bd056efb8 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2022-23546 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23546 · Nota
• https://osv.dev/vulnerability/CVE-2022-23546 · Aviso do Fabricante
• https://t.me/cibsecurity/56007 · Publicação no Telegram
• https://osv.dev/vulnerability/BIT-discourse-2022-23546 · Aviso do Fabricante