PT-2023-19077 · Discourse · Discourse

Pmusaraj · Publicado 2023-02-03 · Atualizado 2024-03-06 · CVE-2023-23615

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to the latest stable, beta and tests-passed versions

Description The issue allows exploitation of embeddable comments to create new topics as any user without a clear title or content.

Recommendations For versions prior to the latest stable, beta and tests-passed versions, update to the latest version to resolve the issue. As a temporary workaround, consider disabling embeddable comments by deleting all embeddable hosts.

Exploit

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

BIT-DISCOURSE-2023-23615

CVE-2023-23615

GHSA-7MF3-5V84-WXQ8

Produtos afetados

Discourse

Referências · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/23xxx/CVE-2023-23615.json · Exploit
• https://github.com/discourse/discourse/security/advisories/GHSA-7mf3-5v84-wxq8 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-23615 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-23615 · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-discourse-2023-23615 · Aviso do Fabricante