CVE-2023-22453
Severity CVSS v4.0:
Pending analysis
Type:
CWE-200
Information Leak / Disclosure
Publication date:
05/01/2023
Last modified:
13/01/2023
Description
Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 3.0.0.beta16 on the `beta` and `tests-passed` branches, the number of times a user posted in an arbitrary topic is exposed to unauthorized users through the `/u/username.json` endpoint. The issue is patched in version 2.8.14 and 3.0.0.beta16. There is no known workaround.
Impact
Base Score 3.x
5.30
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:* | 2.8.14 (excluding) | |
| cpe:2.3:a:discourse:discourse:1.1.0:beta1:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.1.0:beta2:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.1.0:beta3:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.1.0:beta4:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.1.0:beta5:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.1.0:beta6:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.1.0:beta6b:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.1.0:beta7:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.1.0:beta8:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.2.0:beta1:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.2.0:beta2:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.2.0:beta3:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.2.0:beta4:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.2.0:beta5:*:*:beta:*:*:* |
To consult the complete list of CPE names with products and versions, see this page