Design/Logic Flaw

🗓️ 21 Feb 2024 16:15:00Reported by PRIOn knowledge baseType

`discourse-microsoft-auth` plugin allows Microsoft authentication, but vulnerable to attack. Patched in commit c40665f44509724b64938c85def9fb2e79f62ec8. Added `microsoft_auth:revoke` rake task to logout and revoke API keys for affected users. Workaround: disable plugin using `microsoft_auth_enabled` site setting and run `microsoft_auth:log_out_users` rake task

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2023-46241	21 Feb 202417:22	–	circl
CNNVD	Discourse Security Breach	21 Feb 202400:00	–	cnnvd
CVE	CVE-2023-46241	21 Feb 202416:08	–	cve
Cvelist	CVE-2023-46241 Potential account take over due to unverified emails from Microsoft Identity Platform	21 Feb 202416:08	–	cvelist
EUVD	EUVD-2023-50476	3 Oct 202520:07	–	euvd
NVD	CVE-2023-46241	21 Feb 202416:15	–	nvd
OSV	CVE-2023-46241 Potential account take over due to unverified emails from Microsoft Identity Platform	21 Feb 202416:08	–	osv
Positive Technologies	PT-2024-13342 · Discourse · Discourse-Microsoft-Auth	21 Feb 202400:00	–	ptsecurity
Vulnrichment	CVE-2023-46241 Potential account take over due to unverified emails from Microsoft Identity Platform	21 Feb 202416:08	–	vulnrichment

Source	Link
github	www.github.com/discourse/discourse-microsoft-auth/security/advisories/GHSA-2w32-w539-3m7r
github	www.github.com/discourse/discourse-microsoft-auth/commit/c40665f44509724b64938c85def9fb2e79f62ec8
learn	www.learn.microsoft.com/en-us/security/zero-trust/develop/identity-supported-account-types

22 Feb 2024 19:07Current

7.3High risk

Vulners AI Score7.3

EPSS0.00565