PT-2023-22808 · Discourse · Discourse-Reactions

Jomaxro · Published 2023-04-19 · Updated 2023-05-01 · CVE-2023-30611

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Discourse-reactions versions prior to 0.3

Description The Discourse-reactions plugin for the Discourse messaging platform has an issue where data about reactions performed on a post in a private topic could be leaked. This affects the confidentiality of user interactions within private topics.

Recommendations For versions prior to 0.3, upgrade to version 0.3 to fully resolve the issue. For users unable to upgrade, disable the discourse-reactions plugin as a temporary workaround to mitigate the issue.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2023-30611

GHSA-4CGC-C7VH-94G6

Affected Products

Discourse-Reactions

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30611.json · Exploit
• https://github.com/discourse/discourse-reactions/security/advisories/GHSA-4cgc-c7vh-94g6 · Vendor Advisory
• https://github.com/discourse/discourse-reactions/commit/01aca15b2774c088f3673118e92e9469f37d2fb6 · Patch
• https://osv.dev/vulnerability/CVE-2023-30611 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-30611 · Security Note
• https://t.me/cibsecurity/62476 · Telegram Post
• https://t.me/cvenotify/49533 · Telegram Post