PT-2023-24774 · Discourse · Discourse

Jomaxro

·

CVE-2023-34250

·

Publicado

2023-06-13

·

Atualizado

2024-03-06

CVSS v3.1

4.8

Média

VetorAV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.0.4 Discourse versions prior to 3.1.0.beta5
Description An issue in Discourse allows an attacker to use the new topics dismissal endpoint to reveal the number of topics recently created in categories they don't have access to. This does not reveal the actual content of the topics.
Recommendations For versions prior to 3.0.4, update to version 3.0.4 or later. For versions prior to 3.1.0.beta5, update to version 3.1.0.beta5 or later.

Exploit

Correção

Exposure of Resource to Wrong Sphere

Information Disclosure

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-668CWE-200

Identificadores relacionados

BIT-DISCOURSE-2023-34250
CVE-2023-34250
GHSA-Q8M5-WMJR-3PPG

Produtos afetados

Discourse