CVE-2023-38685
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, unauthorized users could obtain information about restricted-visibility topic tags.
Risk Assessment
The organization may be exposed to the disclosure of sensitive information, which could lead to privacy violations for users and damage to the platform's reputation.
Recommendation
It is recommended to upgrade to version 3.0.6 of the `stable` branch or 3.1.0.beta7 of the `beta` and `tests-passed` branches to mitigate this vulnerability.
Original NVD description (English source)
Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, information about restricted-visibility topic tags could be obtained by unauthorized users. The issue is patched in version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches.