PT-2023-24774 · Discourse · Discourse

Jomaxro · Published 2023-06-13 · Updated 2024-03-06 · CVE-2023-34250

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.0.4 Discourse versions prior to 3.1.0.beta5

Description An issue in Discourse allows an attacker to use the new topics dismissal endpoint to reveal the number of topics recently created in categories they don't have access to. This does not reveal the actual content of the topics.

Recommendations For versions prior to 3.0.4, update to version 3.0.4 or later. For versions prior to 3.1.0.beta5, update to version 3.1.0.beta5 or later.

Exploit

Fix

Information Disclosure

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-200

CWE-668

Related Identifiers

BIT-DISCOURSE-2023-34250

CVE-2023-34250

GHSA-Q8M5-WMJR-3PPG

Affected Products

Discourse

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34250.json · Exploit
• https://github.com/discourse/discourse/security/advisories/GHSA-q8m5-wmjr-3ppg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-34250 · Security Note
• https://osv.dev/vulnerability/BIT-discourse-2023-34250 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-34250 · Vendor Advisory
• https://t.me/cvenotify/52246 · Telegram Post