Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
331 results · page 5 of 7
Feb 1, 2024discourse-group-membership-ip-block is a discourse plugin that adds support for adding users to groups based on their IP address.CVE-2024-24755 · Other software · discourse · reported by GitHubMedium 4.3
discourse-group-membership-ip-block is a discourse plugin that adds support for adding users to groups based on their IP address. discourse-group-membership-ip-block was sending all group custom fields to the client, including group custom fields from other plugins which may expect their custom fields to remain secret.
- Product
- discourse-group-membership-ip-block
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2024Discourse is an open-source discussion platform.CVE-2024-23834 · Other software · discourse · reported by GitHubMedium 6.3
Discourse is an open-source discussion platform. Improperly sanitized user input could lead to an XSS vulnerability in some situations. This vulnerability only affects Discourse instances which have disabled the default Content Security Policy. The vulnerability is patched in 3.1.5 and 3.2.0.beta5. As a workaround, ensure Content Security Policy is enabled and does not include `unsafe-inline`.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2024Discourse is a platform for community discussion.CVE-2024-21655 · Other software · discourse · reported by GitHubMedium 4.3
Discourse is a platform for community discussion. For fields that are client editable, limits on sizes are not imposed. This allows a malicious actor to cause a Discourse instance to use excessive disk space and also often excessive bandwidth. The issue is patched 3.1.4 and 3.2.0.beta4.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2024Discourse is a platform for community discussion.CVE-2023-49099 · Other software · discourse · reported by GitHubLow 3.1
Discourse is a platform for community discussion. Under very specific circumstances, secure upload URLs associated with posts can be accessed by guest users even when login is required. This vulnerability has been patched in 3.2.0.beta4 and 3.1.4.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2024Discourse-reactions is a plugin that allows user to add their reactions to the post.CVE-2023-49098 · Other software · discourse · reported by GitHubLow 3.5
Discourse-reactions is a plugin that allows user to add their reactions to the post. Data about a user's reaction notifications could be exposed. This vulnerability was patched in commit 2c26939.
- Product
- discourse-reactions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2024Discourse is a platform for community discussion.CVE-2023-48297 · Other software · discourse · reported by GitHubHigh 8.6
Discourse is a platform for community discussion. The message serializer uses the full list of expanded chat mentions (@all and @here) which can lead to a very long array of users. This issue was patched in versions 3.1.4 and beta 3.2.0.beta5.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2023Discourse is an open source platform for community discussion.CVE-2023-47121 · Other software · discourse · reported by GitHubLow 3.4
Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, the embedding feature is susceptible to server side request forgery. The issue is patched in version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches. As a workaround, disable the Embedding feature.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2023Discourse is an open source platform for community discussion.CVE-2023-47120 · Other software · discourse · reported by GitHubHigh 7.5
Discourse is an open source platform for community discussion. In versions 3.1.0 through 3.1.2 of the `stable` branch and versions 3.1.0,beta6 through 3.2.0.beta2 of the `beta` and `tests-passed` branches, Redis memory can be depleted by crafting a site with an abnormally long favicon URL and drafting multiple posts which Onebox it. The issue is patched in version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches. There are no known workarounds.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2023Discourse is an open source platform for community discussion.CVE-2023-47119 · Other software · discourse · reported by GitHubMedium 5.3
Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, some links can inject arbitrary HTML tags when rendered through our Onebox engine. The issue is patched in version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches. There are no known workarounds.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2023Discourse is an open source platform for community discussion.CVE-2023-46130 · Other software · discourse · reported by GitHubMedium 4.3
Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, some theme components allow users to add svgs with unlimited `height` attributes, and this can affect the availability of subsequent replies in a topic. Most Discourse instances are unaffected, only instances with the svgbob or the mermaid theme component are within scope. The issue is patched in version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches. As a workaround, disable or remove the relevant theme components.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2023Discourse is an open source platform for community discussion.CVE-2023-45816 · Other software · discourse · reported by GitHubLow 3.3
Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, there is an edge case where a bookmark reminder is sent and an unread notification is generated, but the underlying bookmarkable (e.g. post, topic, chat message) security has changed, making it so the user can no longer access the underlying resource. As of version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, bookmark reminders are now no longer sent if the user does not have access to the underlying bookmarkable, and also the unread bookmark notifications are always filtered by access. There are no known workarounds.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2023Discourse is an open source platform for community discussion.CVE-2023-45806 · Other software · discourse · reported by GitHubMedium 4.3
Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, if a user has been quoted and uses a `|` in their full name, they might be able to trigger a bug that generates a lot of duplicate content in all the posts they've been quoted by updating their full name again. Version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches contain a patch for this issue. No known workaround exists, although one can stop the "bleeding" by ensuring users only use alphanumeric characters in their full name field.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2023Discourse is an open source platform for community discussion.CVE-2023-45131 · Other software · discourse · reported by GitHubHigh 7.5
Discourse is an open source platform for community discussion. New chat messages can be read by making an unauthenticated POST request to MessageBus. This issue is patched in the 3.1.1 stable and 3.2.0.beta2 versions of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2023Discourse is an open source platform for community discussion.CVE-2023-44391 · Other software · discourse · reported by GitHubMedium 5.3
Discourse is an open source platform for community discussion. User summaries are accessible for anonymous users even when `hide_user_profiles_from_public` is enabled. This problem has been patched in the 3.1.1 stable and 3.2.0.beta2 version of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2023Discourse is an open source platform for community discussion.CVE-2023-44388 · Other software · discourse · reported by GitHubHigh 7.5
Discourse is an open source platform for community discussion. A malicious request can cause production log files to quickly fill up and thus result in the server running out of disk space. This problem has been patched in the 3.1.1 stable and 3.2.0.beta2 versions of Discourse. It is possible to temporarily work around this problem by reducing the `client_max_body_size nginx directive`. `client_max_body_size` will limit the size of uploads that can be uploaded directly to the server.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2023Discourse is an open source platform for community discussion.CVE-2023-43814 · Other software · discourse · reported by GitHubLow 3.7
Discourse is an open source platform for community discussion. Attackers with details specific to a poll in a topic can use the `/polls/grouped_poll_results` endpoint to view the content of options in the poll and the number of votes for groups of poll participants. This impacts private polls where the results were intended to only be viewable by authorized users. This issue is patched in the 3.1.1 stable and 3.2.0.beta2 versions of Discourse. There is no workaround for this issue apart from upgrading to the fixed version.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2023Discourse is an open source platform for community discussion.CVE-2023-43659 · Other software · discourse · reported by GitHubHigh 8
Discourse is an open source platform for community discussion. Improper escaping of user input allowed for Cross-site Scripting attacks via the digest email preview UI. This issue only affects sites with CSP disabled. This issue has been patched in the 3.1.1 stable release as well as the 3.2.0.beta1 release. Users are advised to upgrade. Users unable to upgrade should ensure CSP is enabled on the forum.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.mozilla.orggithub.com
Oct 16, 2023dicourse-calendar is a plugin for the Discourse messaging platform which adds the ability to create a dynamic calendar in the first post of a topic.CVE-2023-43658 · Other software · discourse · reported by GitHubHigh 8
dicourse-calendar is a plugin for the Discourse messaging platform which adds the ability to create a dynamic calendar in the first post of a topic. Improper escaping of event titles could lead to Cross-site Scripting (XSS) within the 'email preview' UI when a site has CSP disabled. Having CSP disabled is a non-default configuration, so the vast majority of sites are unaffected. This problem is resolved in the latest version of the discourse-calendar plugin. Users are advised to upgrade. Users unable to upgrade should ensure CSP is enabled on the forum.
- Product
- discourse-calendar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.mozilla.orggithub.com
Oct 16, 2023Discourse is an open source community platform.CVE-2023-45147 · Other software · discourse · reported by GitHubMedium 4.9
Discourse is an open source community platform. In affected versions any user can create a topic and add arbitrary custom fields to a topic. The severity of this vulnerability depends on what plugins are installed and how the plugins uses topic custom fields. For a default Discourse installation with the default plugins, this vulnerability has no impact. The problem has been patched in the latest version of Discourse. Users are advised to update to version 3.1.1 if they are on the stable branch or 3.2.0.beta2 if they are on the beta branch. Users unable to upgrade should disable any plugins that access topic custom fields.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2023Discourse-jira is a Discourse plugin allows Jira projects, issue types, fields and field options will be synced automatically.CVE-2023-44384 · Other software · discourse · reported by GitHubMedium 4.1
Discourse-jira is a Discourse plugin allows Jira projects, issue types, fields and field options will be synced automatically. An administrator user can make an SSRF attack by setting the Jira URL to an arbitrary location and enabling the `discourse_jira_verbose_log` site setting. A moderator user could manipulate the request path to the Jira API, allowing them to perform arbitrary GET requests using the Jira API credentials, potentially with elevated permissions, used by the application.
- Product
- discourse-jira
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2023discourse-encrypt is a plugin that provides a secure communication channel through Discourse.CVE-2023-43657 · Other software · discourse · reported by GitHubHigh 7.2
discourse-encrypt is a plugin that provides a secure communication channel through Discourse. Improper escaping of encrypted topic titles could lead to a cross site scripting (XSS) issue when a site has content security policy (CSP) headers disabled. Having CSP disabled is a non-default configuration, and having it disabled with discourse-encrypt installed will result in a warning in the Discourse admin dashboard. This has been fixed in commit `9c75810af9` which is included in the latest version of the discourse-encrypt plugin. Users are advised to upgrade. Users unable to upgrade should ensure that CSP headers are enabled and properly configured.
- Product
- discourse-encrypt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.mozilla.orggithub.com
Sep 15, 2023Discourse is an open-source discussion platform.CVE-2023-41043 · Other software · discourse · reported by GitHubMedium 6.5
Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branches, a malicious admin could create extremely large icons sprites, which would then be cached in each server process. This may cause server processes to be killed and lead to downtime. The issue is patched in version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branches. This is only a concern for multisite installations. No action is required when the admins are trusted.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2023Discourse is an open-source discussion platform.CVE-2023-41042 · Other software · discourse · reported by GitHubMedium 4.9
Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branches, importing a remote theme loads their assets into memory without enforcing limits for file size or number of files. The issue is patched in version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branches. There are no known workarounds.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2023Discourse is an open-source discussion platform.CVE-2023-40588 · Other software · discourse · reported by GitHubMedium 6.5
Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branches, a malicious user could add a 2FA or security key with a carefully crafted name to their account and cause a denial of service for other users. The issue is patched in version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branches. There are no known workarounds.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2023Discourse is an open-source discussion platform.CVE-2023-38706 · Other software · discourse · reported by GitHubMedium 6.5
Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branches, a malicious user can create an unlimited number of drafts with very long draft keys which may end up exhausting the resources on the server. The issue is patched in version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branches. There are no known workarounds.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2023Discourse is an open source discussion platform.CVE-2023-38685 · Other software · discourse · reported by GitHubMedium 4.3
Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, information about restricted-visibility topic tags could be obtained by unauthorized users. The issue is patched in version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2023Discourse is an open source discussion platform.CVE-2023-38684 · Other software · discourse · reported by GitHubMedium 5.3
Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, in multiple controller actions, Discourse accepts limit params but does not impose any upper bound on the values being accepted. Without an upper bound, the software may allow arbitrary users to generate DB queries which may end up exhausting the resources on the server. The issue is patched in version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches. There are no known workarounds for this vulnerability.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2023Discourse is an open source discussion platform.CVE-2023-38498 · Other software · discourse · reported by GitHubMedium 4.3
Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, a malicious user can prevent the defer queue from proceeding promptly on sites hosted in the same multisite installation. The issue is patched in version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches. There are no known workarounds for this vulnerability. Users of multisite configurations should upgrade.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2023Discourse is an open source discussion platform.CVE-2023-37906 · Other software · discourse · reported by GitHubMedium 4.3
Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, a malicious user can edit a post in a topic and cause a DoS with a carefully crafted edit reason. The issue is patched in version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches. There are no known workarounds for this vulnerability.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2023Discourse is an open source discussion platform.CVE-2023-37904 · Other software · discourse · reported by GitHubLow 2.6
Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, more users than permitted could be created from invite links. The issue is patched in version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches. As a workaround, use restrict to email address invites.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2023Discourse is an open source discussion platform.CVE-2023-37467 · Other software · discourse · reported by GitHubMedium 6.8
Discourse is an open source discussion platform. Prior to version 3.1.0.beta7 of the `beta` and `tests-passed` branches, a CSP (Content Security Policy) nonce reuse vulnerability was discovered could allow cross-site scripting (XSS) attacks to bypass CSP protection for anonymous (i.e. unauthenticated) users. There are no known XSS vectors at the moment, but should one be discovered, this vulnerability would allow the XSS attack to bypass CSP and execute successfully. This vulnerability isn't applicable to logged-in users. Version 3.1.0.beta7 contains a patch. The stable branch doesn't have this vulnerability. A workaround to prevent the vulnerability is to disable Google Tag Manager, i.e., unset the `gtm container id` setting.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2023Discourse is an open source discussion platform.CVE-2023-36818 · Other software · discourse · reported by GitHubMedium 6.5
Discourse is an open source discussion platform. In affected versions a request to create or update custom sidebar section can cause a denial of service. This issue has been patched in commit `52b003d915`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2023Discourse is an open source discussion platform.CVE-2023-36466 · Other software · discourse · reported by GitHubLow 3.5
Discourse is an open source discussion platform. When editing a topic, there is a vulnerability that enables a user to bypass the topic title validations for things like title length, number of emojis in title and blank topic titles. The issue is patched in the latest stable, beta and tests-passed version of Discourse.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2023Discourse is an open source discussion platform.CVE-2023-36473 · Other software · discourse · reported by GitHubMedium 6.8
Discourse is an open source discussion platform. A CSP (Content Security Policy) nonce reuse vulnerability could allow XSS attacks to bypass CSP protection. There are no known XSS vectors at the moment, but should one be discovered, this vulnerability would allow the XSS attack to completely bypass CSP. The vulnerability is patched in the latest tests-passed, beta and stable branches.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2023Discourse is an open source discussion platform.CVE-2023-34250 · Other software · discourse · reported by GitHubMedium 4.8
Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches, an attacker could use the new topics dismissal endpoint to reveal the number of topics recently created (but not the actual content thereof) in categories they didn't have access to. This issue is patched in version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches. There are no known workarounds.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2023Discourse is an open source discussion platform.CVE-2023-32301 · Other software · discourse · reported by GitHubLow 3.1
Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches, multiple duplicate topics could be created if topic embedding is enabled. This issue is patched in version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches. As a workaround, disable topic embedding if it has been enabled.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2023Discourse is an open source discussion platform.CVE-2023-32061 · Other software · discourse · reported by GitHubMedium 5.4
Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches, the lack of restrictions on the iFrame tag makes it easy for an attacker to exploit the vulnerability and hide subsequent comments from other users. This issue is patched in version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches. There are no known workarounds.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2023Discourse is an open source discussion platform.CVE-2023-31142 · Other software · discourse · reported by GitHubLow 2
Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches, if a site has modified their general category permissions, they could be set back to the default. This issue is patched in version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches. A workaround, only if you are modifying the general category permissions, is to use a new category for the same purpose.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2023Discourse-reactions is a plugin that allows user to add their reactions to the post in the Discourse messaging platform.CVE-2023-30611 · Other software · discourse · reported by GitHubMedium 4.3
Discourse-reactions is a plugin that allows user to add their reactions to the post in the Discourse messaging platform. In affected versions data about what reactions were performed on a post in a private topic could be leaked. This issue has been addressed in version 0.3. Users are advised to upgrade. Users unable to upgrade should disable the discourse-reactions plugin to fully mitigate the issue.
- Product
- discourse-reactions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2023Discourse is an open source platform for community discussion.CVE-2023-30606 · Other software · discourse · reported by GitHubMedium 4.2
Discourse is an open source platform for community discussion. In affected versions a user logged as an administrator can call arbitrary methods on the `SiteSetting` class, notably `#clear_cache!` and `#notify_changed!`, which when done on a multisite instance, can affect the entire cluster resulting in a denial of service. Users not running in multisite environments are not affected. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2023Discourse is an open source platform for community discussion.CVE-2023-30538 · Other software · discourse · reported by GitHubMedium 5.4
Discourse is an open source platform for community discussion. Due to the improper sanitization of SVG files, an attacker can execute arbitrary JavaScript on the users’ browsers by uploading a crafted SVG file. This issue is patched in the latest stable and tests-passed versions of Discourse. Users are advised to upgrade. For users unable to upgrade there are two possible workarounds: enable CDN handing of uploads (and ensure the CDN sanitizes SVG files) or disable SVG file uploads by ensuring that the `authorized extensions` site setting does not include `svg` (or reset that setting to the default, by default Discourse doesn't enable SVG uploads by users).
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2023Discourse is an open source platform for community discussion.CVE-2023-29196 · Other software · discourse · reported by GitHubMedium 4.2
Discourse is an open source platform for community discussion. This vulnerability is not exploitable on the default install of Discourse. A custom feature must be enabled for it to work at all, and the attacker’s payload must pass the CSP to be executed. However, if an attacker succeeds in embedding Javascript that does pass the CSP, it could result in session hijacking for any users that view the attacker’s post. The vulnerability is patched in the latest tests-passed, beta and stable branches. Users are advised to upgrade. Users unable to upgrade should enable and/or restore your site's CSP to the default one provided with Discourse. Remove any embed-able hosts configured.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2023Discourse is an open source platform for community discussion.CVE-2023-28440 · Other software · discourse · reported by GitHubLow 2.7
Discourse is an open source platform for community discussion. In affected versions a maliciously crafted request from a Discourse administrator can lead to a long-running request and eventual timeout. This has the greatest potential impact in shared hosting environments where admins are untrusted. This issue has been addressed in versions 3.0.3 and 3.1.0.beta4. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2023Discourse is an open-source discussion platform.CVE-2023-28112 · Other software · discourse · reported by GitHubMedium 5.9
Discourse is an open-source discussion platform. Prior to version 3.1.0.beta3 of the `beta` and `tests-passed` branches, some user provided URLs were being passed to FastImage without SSRF protection. Insufficient protections could enable attackers to trigger outbound network connections from the Discourse server to private IP addresses. This affects any site running the `tests-passed` or `beta` branches versions 3.1.0.beta2 and prior. This issue is patched in version 3.1.0.beta3 of the `beta` and `tests-passed` branches. There are no known workarounds.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2023Discourse is an open-source discussion platform.CVE-2023-28111 · Other software · discourse · reported by GitHubMedium 5.7
Discourse is an open-source discussion platform. Prior to version 3.1.0.beta3 of the `beta` and `tests-passed` branches, attackers are able to bypass Discourse's server-side request forgery (SSRF) protection for private IPv4 addresses by using a IPv4-mapped IPv6 address. The issue is patched in the latest beta and tests-passed version of Discourse. version 3.1.0.beta3 of the `beta` and `tests-passed` branches. There are no known workarounds.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2023Discourse is an open-source discussion platform.CVE-2023-28107 · Other software · discourse · reported by GitHubMedium 4.5
Discourse is an open-source discussion platform. Prior to version 3.0.2 of the `stable` branch and version 3.1.0.beta3 of the `beta` and `tests-passed` branches, a user logged as an administrator can request backups multiple times, which will eat up all the connections to the DB. If this is done on a site using multisite, then it can affect the whole cluster. The vulnerability is patched in version 3.0.2 of the `stable` branch and version 3.1.0.beta3 of the `beta` and `tests-passed` branches. There are no known workarounds.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2023Discourse is an open-source discussion platform.CVE-2023-25172 · Other software · discourse · reported by GitHubMedium 4.4
Discourse is an open-source discussion platform. Prior to version 3.0.1 of the `stable` branch and version 3.1.0.beta2 of the `beta` and `tests-passed` branches, a maliciously crafted URL can be included in a user's full name field to to carry out cross-site scripting attacks on sites with a disabled or overly permissive CSP (Content Security Policy). Discourse's default CSP prevents this vulnerability. The vulnerability is patched in version 3.0.1 of the `stable` branch and version 3.1.0.beta2 of the `beta` and `tests-passed` branches. As a workaround, enable and/or restore your site's CSP to the default one provided with Discourse.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2023Discourse is an open-source discussion platform.CVE-2023-26040 · Other software · discourse · reported by GitHubMedium 6.5
Discourse is an open-source discussion platform. Between versions 3.1.0.beta2 and 3.1.0.beta3 of the `tests-passed` branch, editing or responding to a chat message containing malicious content could lead to a cross-site scripting attack. This issue is patched in version 3.1.0.beta3 of the `tests-passed` branch. There are no known workarounds.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2023Discourse is an open-source discussion platform.CVE-2023-23622 · Other software · discourse · reported by GitHubMedium 4.3
Discourse is an open-source discussion platform. Prior to version 3.0.1 of the `stable` branch and version 3.1.0.beta2 of the `beta` and `tests-passed` branches, the count of topics displayed for a tag is a count of all regular topics regardless of whether the topic is in a read restricted category or not. As a result, any users can technically poll a sensitive tag to determine if a new topic is created in a category which the user does not have excess to. In version 3.0.1 of the `stable` branch and version 3.1.0.beta2 of the `beta` and `tests-passed` branches, the count of topics displayed for a tag defaults to only counting regular topics which are not in read restricted categories. Staff users will continue to see a count of all topics regardless of the topic's category read restrictions.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2023Discourse is an open-source messaging platform.CVE-2023-23935 · Other software · discourse · reported by GitHubLow 3.5
Discourse is an open-source messaging platform. In versions 3.0.1 and prior on the `stable` branch and versions 3.1.0.beta2 and prior on the `beta` and `tests-passed` branches, the count of personal messages displayed for a tag is a count of all personal messages regardless of whether the personal message is visible to a given user. As a result, any users can technically poll a sensitive tag to determine if a new personal message is created even if the user does not have access to the personal message. In the patched versions, the count of personal messages tagged with a given tag is hidden by default. To revert to the old behaviour of displaying the count of personal messages for a given tag, an admin may enable the `display_personal_messages_tag_counts` site setting.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.