medium
5.3
CWE
284
Advisory Published
Updated

CVE-2023-23615

First published: Fri Feb 03 2023(Updated: )

Discourse is an open source discussion platform. The embeddable comments can be exploited to create new topics as any user but without any clear title or content. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. As a workaround, disable embeddable comments by deleting all embeddable hosts.

Credit: security-advisories@github.com

Affected SoftwareAffected VersionHow to fix
Discourse Discourse<=3.0.0
Discourse Discourse=1.1.0-beta1
Discourse Discourse=1.1.0-beta2
Discourse Discourse=1.1.0-beta3
Discourse Discourse=1.1.0-beta4
Discourse Discourse=1.1.0-beta5
Discourse Discourse=1.1.0-beta6
Discourse Discourse=1.1.0-beta6b
Discourse Discourse=1.1.0-beta7
Discourse Discourse=1.1.0-beta8
Discourse Discourse=1.2.0-beta1
Discourse Discourse=1.2.0-beta2
Discourse Discourse=1.2.0-beta3
Discourse Discourse=1.2.0-beta4
Discourse Discourse=1.2.0-beta5
Discourse Discourse=1.2.0-beta6
Discourse Discourse=1.2.0-beta7
Discourse Discourse=1.2.0-beta8
Discourse Discourse=1.2.0-beta9
Discourse Discourse=1.3.0-beta1
Discourse Discourse=1.3.0-beta10
Discourse Discourse=1.3.0-beta11
Discourse Discourse=1.3.0-beta2
Discourse Discourse=1.3.0-beta3
Discourse Discourse=1.3.0-beta4
Discourse Discourse=1.3.0-beta5
Discourse Discourse=1.3.0-beta6
Discourse Discourse=1.3.0-beta7
Discourse Discourse=1.3.0-beta8
Discourse Discourse=1.3.0-beta9
Discourse Discourse=1.4.0-beta1
Discourse Discourse=1.4.0-beta10
Discourse Discourse=1.4.0-beta11
Discourse Discourse=1.4.0-beta12
Discourse Discourse=1.4.0-beta2
Discourse Discourse=1.4.0-beta3
Discourse Discourse=1.4.0-beta4
Discourse Discourse=1.4.0-beta5
Discourse Discourse=1.4.0-beta6
Discourse Discourse=1.4.0-beta7
Discourse Discourse=1.4.0-beta8
Discourse Discourse=1.4.0-beta9
Discourse Discourse=1.5.0-beta1
Discourse Discourse=1.5.0-beta10
Discourse Discourse=1.5.0-beta11
Discourse Discourse=1.5.0-beta12
Discourse Discourse=1.5.0-beta13
Discourse Discourse=1.5.0-beta13b
Discourse Discourse=1.5.0-beta14
Discourse Discourse=1.5.0-beta2
Discourse Discourse=1.5.0-beta3
Discourse Discourse=1.5.0-beta4
Discourse Discourse=1.5.0-beta5
Discourse Discourse=1.5.0-beta6
Discourse Discourse=1.5.0-beta7
Discourse Discourse=1.5.0-beta8
Discourse Discourse=1.5.0-beta9
Discourse Discourse=1.6.0-beta1
Discourse Discourse=1.6.0-beta10
Discourse Discourse=1.6.0-beta11
Discourse Discourse=1.6.0-beta12
Discourse Discourse=1.6.0-beta2
Discourse Discourse=1.6.0-beta3
Discourse Discourse=1.6.0-beta4
Discourse Discourse=1.6.0-beta5
Discourse Discourse=1.6.0-beta6
Discourse Discourse=1.6.0-beta7
Discourse Discourse=1.6.0-beta8
Discourse Discourse=1.6.0-beta9
Discourse Discourse=1.7.0-beta1
Discourse Discourse=1.7.0-beta10
Discourse Discourse=1.7.0-beta11
Discourse Discourse=1.7.0-beta2
Discourse Discourse=1.7.0-beta3
Discourse Discourse=1.7.0-beta4
Discourse Discourse=1.7.0-beta5
Discourse Discourse=1.7.0-beta6
Discourse Discourse=1.7.0-beta7
Discourse Discourse=1.7.0-beta8
Discourse Discourse=1.7.0-beta9
Discourse Discourse=1.8.0-beta1
Discourse Discourse=1.8.0-beta10
Discourse Discourse=1.8.0-beta11
Discourse Discourse=1.8.0-beta12
Discourse Discourse=1.8.0-beta13
Discourse Discourse=1.8.0-beta2
Discourse Discourse=1.8.0-beta3
Discourse Discourse=1.8.0-beta4
Discourse Discourse=1.8.0-beta5
Discourse Discourse=1.8.0-beta6
Discourse Discourse=1.8.0-beta7
Discourse Discourse=1.8.0-beta8
Discourse Discourse=1.8.0-beta9
Discourse Discourse=1.9.0-beta1
Discourse Discourse=1.9.0-beta10
Discourse Discourse=1.9.0-beta11
Discourse Discourse=1.9.0-beta12
Discourse Discourse=1.9.0-beta13
Discourse Discourse=1.9.0-beta14
Discourse Discourse=1.9.0-beta15
Discourse Discourse=1.9.0-beta16
Discourse Discourse=1.9.0-beta17
Discourse Discourse=1.9.0-beta2
Discourse Discourse=1.9.0-beta3
Discourse Discourse=1.9.0-beta4
Discourse Discourse=1.9.0-beta5
Discourse Discourse=1.9.0-beta6
Discourse Discourse=1.9.0-beta7
Discourse Discourse=1.9.0-beta8
Discourse Discourse=1.9.0-beta9
Discourse Discourse=2.0.0-beta1
Discourse Discourse=2.0.0-beta10
Discourse Discourse=2.0.0-beta2
Discourse Discourse=2.0.0-beta3
Discourse Discourse=2.0.0-beta4
Discourse Discourse=2.0.0-beta5
Discourse Discourse=2.0.0-beta6
Discourse Discourse=2.0.0-beta7
Discourse Discourse=2.0.0-beta8
Discourse Discourse=2.0.0-beta9
Discourse Discourse=2.1.0-beta1
Discourse Discourse=2.1.0-beta2
Discourse Discourse=2.1.0-beta3
Discourse Discourse=2.1.0-beta4
Discourse Discourse=2.1.0-beta5
Discourse Discourse=2.1.0-beta6
Discourse Discourse=2.2.0-beta1
Discourse Discourse=2.2.0-beta10
Discourse Discourse=2.2.0-beta2
Discourse Discourse=2.2.0-beta3
Discourse Discourse=2.2.0-beta4
Discourse Discourse=2.2.0-beta5
Discourse Discourse=2.2.0-beta6
Discourse Discourse=2.2.0-beta7
Discourse Discourse=2.2.0-beta8
Discourse Discourse=2.2.0-beta9
Discourse Discourse=2.3.0-beta1
Discourse Discourse=2.3.0-beta10
Discourse Discourse=2.3.0-beta11
Discourse Discourse=2.3.0-beta2
Discourse Discourse=2.3.0-beta3
Discourse Discourse=2.3.0-beta4
Discourse Discourse=2.3.0-beta5
Discourse Discourse=2.3.0-beta6
Discourse Discourse=2.3.0-beta7
Discourse Discourse=2.3.0-beta8
Discourse Discourse=2.3.0-beta9
Discourse Discourse=2.4.0-beta1
Discourse Discourse=2.4.0-beta10
Discourse Discourse=2.4.0-beta11
Discourse Discourse=2.4.0-beta2
Discourse Discourse=2.4.0-beta3
Discourse Discourse=2.4.0-beta4
Discourse Discourse=2.4.0-beta5
Discourse Discourse=2.4.0-beta6
Discourse Discourse=2.4.0-beta7
Discourse Discourse=2.4.0-beta8
Discourse Discourse=2.4.0-beta9
Discourse Discourse=2.5.0-beta1
Discourse Discourse=2.5.0-beta2
Discourse Discourse=2.5.0-beta3
Discourse Discourse=2.5.0-beta4
Discourse Discourse=2.5.0-beta5
Discourse Discourse=2.5.0-beta6
Discourse Discourse=2.5.0-beta7
Discourse Discourse=2.6.0-beta1
Discourse Discourse=2.6.0-beta2
Discourse Discourse=2.6.0-beta3
Discourse Discourse=2.6.0-beta4
Discourse Discourse=2.6.0-beta5
Discourse Discourse=2.6.0-beta6
Discourse Discourse=2.7.0-beta1
Discourse Discourse=2.7.0-beta2
Discourse Discourse=2.7.0-beta3
Discourse Discourse=2.7.0-beta4
Discourse Discourse=2.7.0-beta5
Discourse Discourse=2.7.0-beta6
Discourse Discourse=2.7.0-beta7
Discourse Discourse=2.7.0-beta8
Discourse Discourse=2.7.0-beta9
Discourse Discourse=2.8.0-beta1
Discourse Discourse=2.8.0-beta10
Discourse Discourse=2.8.0-beta11
Discourse Discourse=2.8.0-beta2
Discourse Discourse=2.8.0-beta3
Discourse Discourse=2.8.0-beta4
Discourse Discourse=2.8.0-beta5
Discourse Discourse=2.8.0-beta6
Discourse Discourse=2.8.0-beta7
Discourse Discourse=2.8.0-beta8
Discourse Discourse=2.8.0-beta9
Discourse Discourse=2.9.0-beta1
Discourse Discourse=2.9.0-beta10
Discourse Discourse=2.9.0-beta11
Discourse Discourse=2.9.0-beta12
Discourse Discourse=2.9.0-beta13
Discourse Discourse=2.9.0-beta14
Discourse Discourse=2.9.0-beta2
Discourse Discourse=2.9.0-beta3
Discourse Discourse=2.9.0-beta4
Discourse Discourse=2.9.0-beta5
Discourse Discourse=2.9.0-beta6
Discourse Discourse=2.9.0-beta7
Discourse Discourse=2.9.0-beta8
Discourse Discourse=2.9.0-beta9
Discourse Discourse=3.0.0-beta15
Discourse Discourse=3.0.0-beta16
Discourse Discourse=3.1.0-beta1

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the vulnerability ID of this Discourse issue?

    The vulnerability ID is CVE-2023-23615.

  • What is the severity level of CVE-2023-23615?

    The severity level of CVE-2023-23615 is medium with a CVSS score of 5.3.

  • How can I mitigate the vulnerability associated with CVE-2023-23615?

    To mitigate this vulnerability, disable embeddable comments in Discourse until the issue is patched.

  • Is there a patch available for CVE-2023-23615 in Discourse?

    Yes, the issue is patched in the latest stable, beta, and tests-passed versions of Discourse.

  • Where can I find more information about CVE-2023-23615 in Discourse?

    You can refer to the security advisory page at the following link: https://github.com/discourse/discourse/security/advisories/GHSA-7mf3-5v84-wxq8.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203