Skip to content

Restricted tag routes leak topic information

Moderate
pmusaraj published GHSA-hvj9-g84x-5prx Jan 26, 2023

Package

No package listed

Affected versions

stable <= 3.0.0; beta <= 3.1.0.beta1; tests-passed <= 3.0.1.beta1

Patched versions

stable >= 3.0.1; beta >= 3.1.0.beta2; tests-passed >= 3.1.0.beta2

Description

Impact

The contents of latest/top routes for restricted tags can be accessed by unauthorized users.

Patches

This issue is patched in the latest stable and tests-passed versions of Discourse.

Workarounds

No known workarounds.

Severity

Moderate
5.3
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVE ID

CVE-2023-23620

Weaknesses

No CWEs