CVE-2023-34250
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
Discourse is an open source discussion platform, where prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches, an attacker could use the new topics dismissal endpoint to reveal the number of recently created topics in categories they didn't have access to.
Risk Assessment
The organization may be exposed to the disclosure of information about activity in categories, which could lead to unauthorized access to data or breaches of user privacy.
Recommendation
It is recommended to upgrade to version 3.0.4 of the `stable` branch or 3.1.0.beta5 of the `beta` and `tests-passed` branches to mitigate this vulnerability.
Original NVD description (English source)
Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches, an attacker could use the new topics dismissal endpoint to reveal the number of topics recently created (but not the actual content thereof) in categories they didn't have access to. This issue is patched in version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches. There are no known workarounds.