3.5
CVE-2023-49098
- EPSS 0.31%
- Veröffentlicht 12.01.2024 21:15:09
- Zuletzt bearbeitet 21.11.2024 08:32:49
- Quelle security-advisories@github.com
- CVE-Watchlists
- Unerledigt
LoginReaction data for user notifications exposed in Discourse-reactions
Discourse-reactions is a plugin that allows user to add their reactions to the post. Data about a user's reaction notifications could be exposed. This vulnerability was patched in commit 2c26939.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Discourse ≫ Discourse Reactions SwPlatformdiscourse Version <= 0.4
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.31% | 0.221 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 3.5 | 2.1 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
|
| security-advisories@github.com | 3.5 | 2.1 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
|
CWE-284 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
https://github.com/discourse/discourse-reactions/commit/2c26939395177730e492640d71aac68423be84fc
https://github.com/discourse/discourse-reactions/security/advisories/GHSA-mq82-7v5x-rhv8