BIT-discourse-2023-45131

vendorUSosv

Unauthenticated access to new private chat messages in Discourse

view advisory published 2024-03-06Licence: per source

Discourse is an open source platform for community discussion. New chat messages can be read by making an unauthenticated POST request to MessageBus. This issue is patched in the 3.1.1 stable and 3.2.0.beta2 versions of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-45131US	high7.5	3.72% (90th)	Exploit	2023-10-16
Discourse is an open source platform for community discussion. New chat messages can be read by making an unauthenticated POST request to MessageBus. This issue is patched in the 3…

references

External citations — patches, advisories, analysis.

https://github.com/discourse/discourse/security/advisories/GHSA-84gf-hhrc-9pw6ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2023-45131WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan