PT-2023-12729 · Discourse · Discourse

Gregxsunday · Published 2023-01-05 · Updated 2024-03-06 · CVE-2022-23546

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Discourse version 2.9.0.beta14

Description The issue in Discourse, an open-source discussion platform, involves maliciously embedded URLs that can leak an admin's digest of recent topics, potentially exposing private information. A patch is available to address this issue.

Recommendations For version 2.9.0.beta14, update to version 2.9.0.beta15 to resolve the issue. At the moment, there is no information about other workarounds for this issue.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BIT-DISCOURSE-2022-23546

CVE-2022-23546

GHSA-Q9JP-XV4G-328F

Affected Products

Discourse

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23546.json · Exploit
• https://github.com/discourse/discourse/commit/cf862e736565c6fa905c12b5dbe63d0bd056efb8 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-23546 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23546 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-discourse-2022-23546 · Vendor Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-q9jp-xv4g-328f · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23546 · Note
• https://t.me/cibsecurity/56007 · Telegram Post