PT-2023-23575 · Discourse · Discourse

0-0Eth0 + 1 · Published 2023-06-13 · Updated 2024-03-06 · CVE-2023-32061

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.0.4 Discourse versions prior to 3.1.0.beta5

Description The issue is related to the lack of restrictions on the iFrame tag, which makes it easy for an attacker to exploit and hide subsequent comments from other users.

Recommendations For versions prior to 3.0.4, update to version 3.0.4 or later. For versions prior to 3.1.0.beta5, update to version 3.1.0.beta5 or later.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BIT-DISCOURSE-2023-32061

CVE-2023-32061

GHSA-PRX4-49M8-874G

Affected Products

Discourse

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32061.json · Exploit
• https://github.com/discourse/discourse/security/advisories/GHSA-prx4-49m8-874g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-32061 · Security Note
• https://osv.dev/vulnerability/CVE-2023-32061 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-discourse-2023-32061 · Vendor Advisory
• https://t.me/cvenotify/52248 · Telegram Post
• https://t.me/cvenotify/52915 · Telegram Post