Lucene search

GoogleOSV:BIT-DISCOURSE-2023-23615

HistoryMar 06, 2024 - 11:00 a.m.

BIT-discourse-2023-23615

2024-03-0611:00:56

Google

osv.dev

open source

discussion platform

embeddable comments

exploitation

new topics

title

content

patch

workaround

disable

software

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

6.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

27.1%

JSON

Discourse is an open source discussion platform. The embeddable comments can be exploited to create new topics as any user but without any clear title or content. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. As a workaround, disable embeddable comments by deleting all embeddable hosts.

CPENameOperatorVersion
discoursege1.6.0-beta12
discoursege2.4.0-beta11
discoursege2.4.0-beta5
discoursele2.0.0-beta7
discoursege2.9.0-beta9
discoursele1.5.0-beta11
discoursege1.3.0-beta4
discoursele2.3.0-beta3
discoursege1.3.0-beta6
discoursege2.7.0-beta6

Name	Operator	Version
discourse	ge	1.6.0-beta12
discourse	ge	2.4.0-beta11
discourse	ge	2.4.0-beta5
discourse	le	2.0.0-beta7
discourse	ge	2.9.0-beta9
discourse	le	1.5.0-beta11
discourse	ge	1.3.0-beta4
discourse	le	2.3.0-beta3
discourse	ge	1.3.0-beta6
discourse	ge	2.7.0-beta6

Rows per page:

1-10 of 4151

References

github.com/discourse/discourse/security/advisories/GHSA-7mf3-5v84-wxq8

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

6.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

27.1%

JSON

Related for OSV:BIT-DISCOURSE-2023-23615