PT-2023-19954 · Discourse · Discourse Yearly Review Plugin

Jomaxro · Published 2023-03-06 · Updated 2023-03-13 · CVE-2023-25169

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Discourse Yearly Review plugin (affected versions not specified)

Description The Discourse Yearly Review plugin has an issue where a user present in a yearly review topic that is then anonymized will still have some data linked to its original account. This issue has been patched in the latest version of the plugin.

Recommendations To resolve the issue, users are advised to upgrade to the latest version of the Discourse Yearly Review plugin. Users unable to upgrade may disable the yearly review enabled setting to fully mitigate the issue. It's also possible to edit the anonymized user's old data in the yearly review topics manually.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2023-25169

GHSA-X2R8-V85C-X3X7

Affected Products

Discourse Yearly Review Plugin

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25169.json · Exploit
• https://github.com/discourse/discourse-yearly-review/security/advisories/GHSA-x2r8-v85c-x3x7 · Vendor Advisory
• https://github.com/discourse/discourse-yearly-review/commit/b3ab33bbf7130fca54764cf0336395a8a1eeaf3c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-25169 · Security Note
• https://osv.dev/vulnerability/CVE-2023-25169 · Vendor Advisory
• https://t.me/cvenotify/45628 · Telegram Post
• https://t.me/cibsecurity/59497 · Telegram Post