PT-2023-19954 · Discourse · Discourse Yearly Review Plugin

Jomaxro · CVE-2023-25169 · Publicado 2023-03-06 · Atualizado 2023-03-13

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Baixa

Vetor base

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Discourse Yearly Review plugin (affected versions not specified)

Description The Discourse Yearly Review plugin has an issue where a user present in a yearly review topic that is then anonymized will still have some data linked to its original account. This issue has been patched in the latest version of the plugin.

Recommendations To resolve the issue, users are advised to upgrade to the latest version of the Discourse Yearly Review plugin. Users unable to upgrade may disable the yearly review enabled setting to fully mitigate the issue. It's also possible to edit the anonymized user's old data in the yearly review topics manually.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2023-25169

GHSA-X2R8-V85C-X3X7

Produtos afetados

Discourse Yearly Review Plugin

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25169.json · Exploit
• https://github.com/discourse/discourse-yearly-review/security/advisories/GHSA-x2r8-v85c-x3x7 · Aviso do Fabricante
• https://github.com/discourse/discourse-yearly-review/commit/b3ab33bbf7130fca54764cf0336395a8a1eeaf3c · Correção
• https://t.me/cvenotify/45628 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-25169 · Nota de Segurança
• https://t.me/cibsecurity/59497 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-25169 · Aviso do Fabricante