PT-2023-19084 · Discourse · Discourse

Pmusaraj · Publicado 2023-01-27 · Atualizado 2024-03-06 · CVE-2023-23624

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.0.1 on the stable branch Discourse versions prior to 3.1.0.beta2 on the beta and tests-passed branches

Description The issue affects Discourse, an open-source discussion platform, where someone can use the exclude tag param to filter out topics and deduce which ones were using a specific hidden tag. This affects any Discourse site using hidden tags in public categories.

Recommendations For versions prior to 3.0.1 on the stable branch, update to version 3.0.1 or later. For versions prior to 3.1.0.beta2 on the beta and tests-passed branches, update to version 3.1.0.beta2 or later. As a temporary workaround, consider securing any categories that are using hidden tags, changing any existing hidden tags to not include private data, or removing any hidden tags currently in use.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BIT-DISCOURSE-2023-23624

CVE-2023-23624

GHSA-QGJ5-G5VF-FM7Q

Produtos afetados

Discourse

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/23xxx/CVE-2023-23624.json · Exploit
• https://github.com/discourse/discourse/pull/20006 · Correção
• https://github.com/discourse/discourse/security/advisories/GHSA-qgj5-g5vf-fm7q · Nota
• https://github.com/discourse/discourse/commit/f55e0fe7910149c431861c18ce407d1be0d6091a · Correção
• https://osv.dev/vulnerability/CVE-2023-23624 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-23624 · Nota de Segurança
• https://osv.dev/vulnerability/BIT-discourse-2023-23624 · Aviso do Fabricante
• https://t.me/cibsecurity/57117 · Publicação no Telegram