PT-2023-19307 · Discourse · Discourse

Jomaxro · Published 2023-03-16 · Updated 2024-03-06 · CVE-2023-23935

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions 3.0.1 and prior Discourse versions 3.1.0.beta2 and prior

Description The issue affects the count of personal messages displayed for a tag, which includes all personal messages regardless of visibility to a given user. This allows users to poll a sensitive tag and determine if a new personal message is created, even without access to the message. The count of personal messages tagged with a given tag is hidden by default in patched versions. An admin can enable the display personal messages tag counts site setting to revert to the old behavior.

Recommendations For Discourse versions 3.0.1 and prior, update to a version where the count of personal messages tagged with a given tag is hidden by default. For Discourse versions 3.1.0.beta2 and prior, update to a version where the count of personal messages tagged with a given tag is hidden by default. As a temporary workaround, consider disabling the display of personal message tag counts until a patch is available.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BIT-DISCOURSE-2023-23935

CVE-2023-23935

GHSA-RF8J-MF8C-82V7

Affected Products

Discourse

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/23xxx/CVE-2023-23935.json · Exploit
• https://github.com/discourse/discourse/security/advisories/GHSA-rf8j-mf8c-82v7 · Vendor Advisory
• https://github.com/discourse/discourse/commit/f31f0b70f82c43d93220ce6fc0d4f57440452f37 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-23935 · Security Note
• https://osv.dev/vulnerability/CVE-2023-23935 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-discourse-2023-23935 · Vendor Advisory
• https://t.me/cibsecurity/60217 · Telegram Post