Discourse up to 3.0.0/3.1.0.beta1 Topic information disclosure

Summaryinfo

A vulnerability described as problematic has been identified in Discourse up to 3.0.0/3.1.0.beta1. The impacted element is an unknown function of the component Topic Handler. Such manipulation leads to information disclosure. This vulnerability is referenced as CVE-2023-23622. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Discourse up to 3.0.0/3.1.0.beta1 and classified as problematic. Affected by this issue is an unknown code block of the component Topic Handler. The manipulation with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality. CVE summarizes:

Discourse is an open-source discussion platform. Prior to version 3.0.1 of the `stable` branch and version 3.1.0.beta2 of the `beta` and `tests-passed` branches, the count of topics displayed for a tag is a count of all regular topics regardless of whether the topic is in a read restricted category or not. As a result, any users can technically poll a sensitive tag to determine if a new topic is created in a category which the user does not have excess to. In version 3.0.1 of the `stable` branch and version 3.1.0.beta2 of the `beta` and `tests-passed` branches, the count of topics displayed for a tag defaults to only counting regular topics which are not in read restricted categories. Staff users will continue to see a count of all topics regardless of the topic's category read restrictions.

The weakness was published 03/18/2023 as GHSA-2wvr-4x7w-v795. The advisory is shared for download at github.com. This vulnerability is handled as CVE-2023-23622 since 01/16/2023. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1592.

Upgrading to version 3.0.1 or 3.1.0.beta2 eliminates this vulnerability. Applying the patch 105fee978d73b0ec23ff814a09d1c0c9ace95164 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Chat Software

Name

• Discourse

Version

• 3.0
• 3.1.0.beta1

License

• open-source

Website

• Product: https://github.com/discourse/discourse/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion