icon

We found results for “

CVE-2023-34250

Date: June 13, 2023

Discourse is an open source discussion platform. Prior to version 3.0.4 of the "stable" branch and version 3.1.0.beta5 of the "beta" and "tests-passed" branches, an attacker could use the new topics dismissal endpoint to reveal the number of topics recently created (but not the actual content thereof) in categories they didn't have access to. This issue is patched in version 3.0.4 of the "stable" branch and version 3.1.0.beta5 of the "beta" and "tests-passed" branches. There are no known workarounds.

Language: Ruby

Severity Score

Severity Score

Weakness Type (CWE)

Exposure of Resource to Wrong Sphere

CWE-668

Exposure of Sensitive Information to an Unauthorized Actor

CWE-200

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): HIGH
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): LOW
Integrity (I): NONE
Availability (A): LOW

Do you need more information?

Contact Us