CVE-2023-25819

Summary

Discourse is an open source platform for community discussion. Tags that are normally private are showing in metadata. This affects any site running the tests-passed or beta branches >= 3.1.0.beta2. The issue is patched in the latest beta and tests-passed version of Discourse.

Affected Software

Weaknesses

• CWE-359: CWE-359: Exposure of Private Personal Information to an Unauthorized Actor

ADP Enrichment

CVE Program Container

Additional References

• https://github.com/discourse/discourse/security/advisories/GHSA-xx2h-mwm7-hq6q
• https://github.com/discourse/discourse/commit/a9f2c6db64e7d78b8e0f55e7bd77c5fe3459b831

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: partial

References

• https://github.com/discourse/discourse/security/advisories/GHSA-xx2h-mwm7-hq6q
• https://github.com/discourse/discourse/commit/a9f2c6db64e7d78b8e0f55e7bd77c5fe3459b831

• ←Previous
• Next→