Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
NVD Vulnerability Details :
CVE-2023-45816
Analyzed
More InfoOfficial Page
Source-security-advisories@github.com
View Known Exploited Vulnerability (KEV) details
Published At-10 Nov, 2023 | 15:15
Updated At-16 Nov, 2023 | 19:38

Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, there is an edge case where a bookmark reminder is sent and an unread notification is generated, but the underlying bookmarkable (e.g. post, topic, chat message) security has changed, making it so the user can no longer access the underlying resource. As of version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, bookmark reminders are now no longer sent if the user does not have access to the underlying bookmarkable, and also the unread bookmark notifications are always filtered by access. There are no known workarounds.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Primary3.13.3LOW
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Secondary3.13.3LOW
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Type: Primary
Version: 3.1
Base score: 3.3
Base severity: LOW
Vector:
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Type: Secondary
Version: 3.1
Base score: 3.3
Base severity: LOW
Vector:
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
CPE Matches

Civilized Discourse Construction Kit, Inc.
discourse
>>discourse>>Versions before 3.1.3(exclusive)
cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*
Civilized Discourse Construction Kit, Inc.
discourse
>>discourse>>Versions before 3.2.0(exclusive)
cpe:2.3:a:discourse:discourse:*:*:*:*:beta:*:*:*
Civilized Discourse Construction Kit, Inc.
discourse
>>discourse>>3.2.0
cpe:2.3:a:discourse:discourse:3.2.0:beta1:*:*:beta:*:*:*
Civilized Discourse Construction Kit, Inc.
discourse
>>discourse>>3.2.0
cpe:2.3:a:discourse:discourse:3.2.0:beta2:*:*:beta:*:*:*
Weaknesses
CWE IDTypeSource
CWE-200Primarysecurity-advisories@github.com
CWE ID: CWE-200
Type: Primary
Source: security-advisories@github.com
Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References
HyperlinkSourceResource
https://github.com/discourse/discourse/commit/2c45b949ea0e9d6fa8e5af2dd07f6521ede08bf1security-advisories@github.com
Patch
https://github.com/discourse/discourse/commit/3c5fb871c0f54af47679ae71ad449666b01d8216security-advisories@github.com
Patch
https://github.com/discourse/discourse/security/advisories/GHSA-v9r6-92wp-f6cfsecurity-advisories@github.com
Vendor Advisory
Hyperlink: https://github.com/discourse/discourse/commit/2c45b949ea0e9d6fa8e5af2dd07f6521ede08bf1
Source: security-advisories@github.com
Resource:
Patch
Hyperlink: https://github.com/discourse/discourse/commit/3c5fb871c0f54af47679ae71ad449666b01d8216
Source: security-advisories@github.com
Resource:
Patch
Hyperlink: https://github.com/discourse/discourse/security/advisories/GHSA-v9r6-92wp-f6cf
Source: security-advisories@github.com
Resource:
Vendor Advisory
Change History
0Changes found

Details not found