CVE-2023-37904
Severity CVSS v4.0:
Pending analysis
Type:
CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Publication date:
28/07/2023
Last modified:
03/08/2023
Description
Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, more users than permitted could be created from invite links. The issue is patched in version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches. As a workaround, use restrict to email address invites.
Impact
Base Score 3.x
3.10
Severity 3.x
LOW
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:* | 3.0.6 (excluding) | |
| cpe:2.3:a:discourse:discourse:1.1.0:beta1:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.1.0:beta2:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.1.0:beta3:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.1.0:beta4:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.1.0:beta5:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.1.0:beta6:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.1.0:beta6b:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.1.0:beta7:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.1.0:beta8:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.2.0:beta1:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.2.0:beta2:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.2.0:beta3:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.2.0:beta4:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.2.0:beta5:*:*:beta:*:*:* |
To consult the complete list of CPE names with products and versions, see this page