BIT-discourse-2023-36466

vendorUSosv

Topic Title Validation Skipped When Changing Category in Discourse

view advisory published 2024-03-06Licence: per source

Discourse is an open source discussion platform. When editing a topic, there is a vulnerability that enables a user to bypass the topic title validations for things like title length, number of emojis in title and blank topic titles. The issue is patched in the latest stable, beta and tests-passed version of Discourse.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-36466US	medium4.3	0.40% (34th)	—	2023-07-14
Discourse is an open source discussion platform. When editing a topic, there is a vulnerability that enables a user to bypass the topic title validations for things like title leng…

references

External citations — patches, advisories, analysis.

https://github.com/discourse/discourse/security/advisories/GHSA-4hjh-wg43-p932ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2023-36466WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan