CVE-2023-23620
Severity CVSS v4.0:
Pending analysis
Type:
CWE-200
Information Leak / Disclosure
Publication date:
28/01/2023
Last modified:
14/02/2023
Description
Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and 3.1.0.beta2 on the `beta` and `tests-passed` branches, the contents of latest/top routes for restricted tags can be accessed by unauthorized users. This issue is patched in version 3.0.1 on the `stable` branch and 3.1.0.beta2 on the `beta` and `tests-passed` branches. There are no known workarounds.
Impact
Base Score 3.x
5.30
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:* | 3.0.1 (excluding) | |
| cpe:2.3:a:discourse:discourse:1.1.0:beta1:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.1.0:beta2:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.1.0:beta3:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.1.0:beta4:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.1.0:beta5:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.1.0:beta6:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.1.0:beta6b:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.1.0:beta7:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.1.0:beta8:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.2.0:beta1:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.2.0:beta2:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.2.0:beta3:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.2.0:beta4:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.2.0:beta5:*:*:beta:*:*:* |
To consult the complete list of CPE names with products and versions, see this page