5.3
CVE-2023-23620
- EPSS 0.67%
- Veröffentlicht 28.01.2023 00:15:09
- Zuletzt bearbeitet 21.11.2024 07:46:32
- Quelle security-advisories@github.com
- CVE-Watchlists
- Unerledigt
LoginDiscourse restricted tag routes leak topic information
Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and 3.1.0.beta2 on the `beta` and `tests-passed` branches, the contents of latest/top routes for restricted tags can be accessed by unauthorized users. This issue is patched in version 3.0.1 on the `stable` branch and 3.1.0.beta2 on the `beta` and `tests-passed` branches. There are no known workarounds.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.67% | 0.47 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 5.3 | 3.9 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
|
| security-advisories@github.com | 5.3 | 3.9 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
|
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
https://github.com/discourse/discourse/commit/105fee978d73b0ec23ff814a09d1c0c9ace95164
https://github.com/discourse/discourse/pull/20004
https://github.com/discourse/discourse/security/advisories/GHSA-hvj9-g84x-5prx