CVE-2023-25819

CVSS V2 None CVSS V3 None
Description
Discourse is an open source platform for community discussion. Tags that are normally private are showing in metadata. This affects any site running the `tests-passed` or `beta` branches >= 3.1.0.beta2. The issue is patched in the latest `beta` and `tests-passed` version of Discourse.
Overview
  • CVE ID
  • CVE-2023-25819
  • Assigner
  • security-advisories@github.com
  • Vulnerability Status
  • Analyzed
  • Published Version
  • 2023-03-04T01:15:10
  • Last Modified Date
  • 2023-03-09T21:11:07
Weakness Enumerations
CWE URL
CWE-200 http://cwe.mitre.org/data/definitions/200.html
CWE-359 http://cwe.mitre.org/data/definitions/359.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:* 1 OR 3.1.0
cpe:2.3:a:discourse:discourse:3.1.0:beta1:*:*:beta:*:*:* 1 OR
cpe:2.3:a:discourse:discourse:3.1.0:beta2:*:*:beta:*:*:* 1 OR
References
Reference URL Reference Tags
https://github.com/discourse/discourse/commit/a9f2c6db64e7d78b8e0f55e7bd77c5fe3459b831 Patch
https://github.com/discourse/discourse/security/advisories/GHSA-xx2h-mwm7-hq6q Third Party Advisory
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2023-25819
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25819
History
Created Old Value New Value Data Type Notes
2023-04-17 05:56:19 Added to TrackCVE
2023-04-17 05:56:22 Weakness Enumeration new