PT-2023-23575 · Discourse · Discourse

0-0Eth0 + 1 · Publicado 2023-06-13 · Atualizado 2024-03-06 · CVE-2023-32061

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.0.4 Discourse versions prior to 3.1.0.beta5

Description The issue is related to the lack of restrictions on the iFrame tag, which makes it easy for an attacker to exploit and hide subsequent comments from other users.

Recommendations For versions prior to 3.0.4, update to version 3.0.4 or later. For versions prior to 3.1.0.beta5, update to version 3.1.0.beta5 or later.

Exploit

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

BIT-DISCOURSE-2023-32061

CVE-2023-32061

GHSA-PRX4-49M8-874G

Produtos afetados

Discourse

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32061.json · Exploit
• https://github.com/discourse/discourse/security/advisories/GHSA-prx4-49m8-874g · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-32061 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-32061 · Aviso do Fabricante
• https://t.me/cvenotify/52248 · Publicação no Telegram
• https://osv.dev/vulnerability/BIT-discourse-2023-32061 · Aviso do Fabricante
• https://t.me/cvenotify/52915 · Publicação no Telegram