PT-2023-29438 · Discourse · Discourse

Jomaxro · Publicado 2023-10-16 · Atualizado 2024-03-06 · CVE-2023-45147

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Média

Vetor base

AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.1.1 Discourse versions prior to 3.2.0.beta2

Description Discourse is an open source community platform. In affected versions, any user can create a topic and add arbitrary custom fields to a topic. The severity of this issue depends on what plugins are installed and how the plugins use topic custom fields. For a default Discourse installation with the default plugins, this issue has no impact.

Recommendations For versions prior to 3.1.1 on the stable branch, update to version 3.1.1. For versions prior to 3.2.0.beta2 on the beta branch, update to version 3.2.0.beta2. If an update is not possible, disable any plugins that access topic custom fields as a temporary workaround.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BIT-DISCOURSE-2023-45147

CVE-2023-45147

GHSA-WM89-M359-F9QV

Produtos afetados

Discourse

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45147.json · Exploit
• https://github.com/discourse/discourse/security/advisories/GHSA-wm89-m359-f9qv · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-45147 · Nota de Segurança
• https://twitter.com/CVEnew/status/1714018233735426172 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1714049955130712140 · Publicação no Twitter
• https://osv.dev/vulnerability/BIT-discourse-2023-45147 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-45147 · Aviso do Fabricante