PT-2023-29438 · Discourse · Discourse

Jomaxro · Published 2023-10-16 · Updated 2024-03-06 · CVE-2023-45147

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.1.1 Discourse versions prior to 3.2.0.beta2

Description Discourse is an open source community platform. In affected versions, any user can create a topic and add arbitrary custom fields to a topic. The severity of this issue depends on what plugins are installed and how the plugins use topic custom fields. For a default Discourse installation with the default plugins, this issue has no impact.

Recommendations For versions prior to 3.1.1 on the stable branch, update to version 3.1.1. For versions prior to 3.2.0.beta2 on the beta branch, update to version 3.2.0.beta2. If an update is not possible, disable any plugins that access topic custom fields as a temporary workaround.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BIT-DISCOURSE-2023-45147

CVE-2023-45147

GHSA-WM89-M359-F9QV

Affected Products

Discourse

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45147.json · Exploit
• https://github.com/discourse/discourse/security/advisories/GHSA-wm89-m359-f9qv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-45147 · Security Note
• https://osv.dev/vulnerability/BIT-discourse-2023-45147 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-45147 · Vendor Advisory
• https://twitter.com/CVEnew/status/1714018233735426172 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1714049955130712140 · Twitter Post