CVE-2023-23624: Discourse's exclude_tags param could leak which topics had a specific hidden tag
Published Jan 27, 2023
·Updated
Discourse is an open-source discussion platform. Prior to version 3.0.1 on the stable branch and version 3.1.0.beta2 on the beta and tests-passed branches, someone can use the excludetag param to filter out topics and deduce which ones were using a specific hidden tag. This affects any Discourse site using hidden tags in public categories. This issue is patched in version 3.0.1 on the stable branch and version 3.1.0.beta2 on the beta and tests-passed branches. As a workaround, secure any categories that are using hidden tags, change any existing hidden tags to not include private data, or remove any hidden tags currently in use.
Affected Software
208 affected components
Discourse Discourse<3.0.1
Discourse Discourse=1.1.0-beta1
Discourse Discourse=1.1.0-beta2
Discourse Discourse=1.1.0-beta3
Discourse Discourse=1.1.0-beta4
Discourse Discourse=1.1.0-beta5
Discourse Discourse=1.1.0-beta6
Discourse Discourse=1.1.0-beta6b
Discourse Discourse=1.1.0-beta7
Discourse Discourse=1.1.0-beta8
Discourse Discourse=1.2.0-beta1
Discourse Discourse=1.2.0-beta2
Discourse Discourse=1.2.0-beta3
Discourse Discourse=1.2.0-beta4
Discourse Discourse=1.2.0-beta5
Discourse Discourse=1.2.0-beta6
Discourse Discourse=1.2.0-beta7
Discourse Discourse=1.2.0-beta8
Discourse Discourse=1.2.0-beta9
Discourse Discourse=1.3.0-beta1
Discourse Discourse=1.3.0-beta10
Discourse Discourse=1.3.0-beta11
Discourse Discourse=1.3.0-beta2
Discourse Discourse=1.3.0-beta3
Discourse Discourse=1.3.0-beta4
Discourse Discourse=1.3.0-beta5
Discourse Discourse=1.3.0-beta6
Discourse Discourse=1.3.0-beta7
Discourse Discourse=1.3.0-beta8
Discourse Discourse=1.3.0-beta9
Discourse Discourse=1.4.0-beta1
Discourse Discourse=1.4.0-beta10
Discourse Discourse=1.4.0-beta11
Discourse Discourse=1.4.0-beta12
Discourse Discourse=1.4.0-beta2
Discourse Discourse=1.4.0-beta3
Discourse Discourse=1.4.0-beta4
Discourse Discourse=1.4.0-beta5
Discourse Discourse=1.4.0-beta6
Discourse Discourse=1.4.0-beta7
Discourse Discourse=1.4.0-beta8
Discourse Discourse=1.4.0-beta9
Discourse Discourse=1.5.0-beta1
Discourse Discourse=1.5.0-beta10
Discourse Discourse=1.5.0-beta11
Discourse Discourse=1.5.0-beta12
Discourse Discourse=1.5.0-beta13
Discourse Discourse=1.5.0-beta13b
Discourse Discourse=1.5.0-beta14
Discourse Discourse=1.5.0-beta2
Discourse Discourse=1.5.0-beta3
Discourse Discourse=1.5.0-beta4
Discourse Discourse=1.5.0-beta5
Discourse Discourse=1.5.0-beta6
Discourse Discourse=1.5.0-beta7
Discourse Discourse=1.5.0-beta8
Discourse Discourse=1.5.0-beta9
Discourse Discourse=1.6.0-beta1
Discourse Discourse=1.6.0-beta10
Discourse Discourse=1.6.0-beta11
Discourse Discourse=1.6.0-beta12
Discourse Discourse=1.6.0-beta2
Discourse Discourse=1.6.0-beta3
Discourse Discourse=1.6.0-beta4
Discourse Discourse=1.6.0-beta5
Discourse Discourse=1.6.0-beta6
Discourse Discourse=1.6.0-beta7
Discourse Discourse=1.6.0-beta8
Discourse Discourse=1.6.0-beta9
Discourse Discourse=1.7.0-beta1
Discourse Discourse=1.7.0-beta10
Discourse Discourse=1.7.0-beta11
Discourse Discourse=1.7.0-beta2
Discourse Discourse=1.7.0-beta3
Discourse Discourse=1.7.0-beta4
Discourse Discourse=1.7.0-beta5
Discourse Discourse=1.7.0-beta6
Discourse Discourse=1.7.0-beta7
Discourse Discourse=1.7.0-beta8
Discourse Discourse=1.7.0-beta9
Discourse Discourse=1.8.0-beta1
Discourse Discourse=1.8.0-beta10
Discourse Discourse=1.8.0-beta11
Discourse Discourse=1.8.0-beta12
Discourse Discourse=1.8.0-beta13
Discourse Discourse=1.8.0-beta2
Discourse Discourse=1.8.0-beta3
Discourse Discourse=1.8.0-beta4
Discourse Discourse=1.8.0-beta5
Discourse Discourse=1.8.0-beta6
Discourse Discourse=1.8.0-beta7
Discourse Discourse=1.8.0-beta8
Discourse Discourse=1.8.0-beta9
Discourse Discourse=1.9.0-beta1
Discourse Discourse=1.9.0-beta10
Discourse Discourse=1.9.0-beta11
Discourse Discourse=1.9.0-beta12
Discourse Discourse=1.9.0-beta13
Discourse Discourse=1.9.0-beta14
Discourse Discourse=1.9.0-beta15
Discourse Discourse=1.9.0-beta16
Discourse Discourse=1.9.0-beta17
Discourse Discourse=1.9.0-beta2
Discourse Discourse=1.9.0-beta3
Discourse Discourse=1.9.0-beta4
Discourse Discourse=1.9.0-beta5
Discourse Discourse=1.9.0-beta6
Discourse Discourse=1.9.0-beta7
Discourse Discourse=1.9.0-beta8
Discourse Discourse=1.9.0-beta9
Discourse Discourse=2.0.0-beta1
Discourse Discourse=2.0.0-beta10
Discourse Discourse=2.0.0-beta2
Discourse Discourse=2.0.0-beta3
Discourse Discourse=2.0.0-beta4
Discourse Discourse=2.0.0-beta5
Discourse Discourse=2.0.0-beta6
Discourse Discourse=2.0.0-beta7
Discourse Discourse=2.0.0-beta8
Discourse Discourse=2.0.0-beta9
Discourse Discourse=2.1.0-beta1
Discourse Discourse=2.1.0-beta2
Discourse Discourse=2.1.0-beta3
Discourse Discourse=2.1.0-beta4
Discourse Discourse=2.1.0-beta5
Discourse Discourse=2.1.0-beta6
Discourse Discourse=2.2.0-beta1
Discourse Discourse=2.2.0-beta10
Discourse Discourse=2.2.0-beta2
Discourse Discourse=2.2.0-beta3
Discourse Discourse=2.2.0-beta4
Discourse Discourse=2.2.0-beta5
Discourse Discourse=2.2.0-beta6
Discourse Discourse=2.2.0-beta7
Discourse Discourse=2.2.0-beta8
Discourse Discourse=2.2.0-beta9
Discourse Discourse=2.3.0-beta1
Discourse Discourse=2.3.0-beta10
Discourse Discourse=2.3.0-beta11
Discourse Discourse=2.3.0-beta2
Discourse Discourse=2.3.0-beta3
Discourse Discourse=2.3.0-beta4
Discourse Discourse=2.3.0-beta5
Discourse Discourse=2.3.0-beta6
Discourse Discourse=2.3.0-beta7
Discourse Discourse=2.3.0-beta8
Discourse Discourse=2.3.0-beta9
Discourse Discourse=2.4.0-beta1
Discourse Discourse=2.4.0-beta10
Discourse Discourse=2.4.0-beta11
Discourse Discourse=2.4.0-beta2
Discourse Discourse=2.4.0-beta3
Discourse Discourse=2.4.0-beta4
Discourse Discourse=2.4.0-beta5
Discourse Discourse=2.4.0-beta6
Discourse Discourse=2.4.0-beta7
Discourse Discourse=2.4.0-beta8
Discourse Discourse=2.4.0-beta9
Discourse Discourse=2.5.0-beta1
Discourse Discourse=2.5.0-beta2
Discourse Discourse=2.5.0-beta3
Discourse Discourse=2.5.0-beta4
Discourse Discourse=2.5.0-beta5
Discourse Discourse=2.5.0-beta6
Discourse Discourse=2.5.0-beta7
Discourse Discourse=2.6.0-beta1
Discourse Discourse=2.6.0-beta2
Discourse Discourse=2.6.0-beta3
Discourse Discourse=2.6.0-beta4
Discourse Discourse=2.6.0-beta5
Discourse Discourse=2.6.0-beta6
Discourse Discourse=2.7.0-beta1
Discourse Discourse=2.7.0-beta2
Discourse Discourse=2.7.0-beta3
Discourse Discourse=2.7.0-beta4
Discourse Discourse=2.7.0-beta5
Discourse Discourse=2.7.0-beta6
Discourse Discourse=2.7.0-beta7
Discourse Discourse=2.7.0-beta8
Discourse Discourse=2.7.0-beta9
Discourse Discourse=2.8.0-beta1
Discourse Discourse=2.8.0-beta10
Discourse Discourse=2.8.0-beta11
Discourse Discourse=2.8.0-beta2
Discourse Discourse=2.8.0-beta3
Discourse Discourse=2.8.0-beta4
Discourse Discourse=2.8.0-beta5
Discourse Discourse=2.8.0-beta6
Discourse Discourse=2.8.0-beta7
Discourse Discourse=2.8.0-beta8
Discourse Discourse=2.8.0-beta9
Discourse Discourse=2.9.0-beta1
Discourse Discourse=2.9.0-beta10
Discourse Discourse=2.9.0-beta11
Discourse Discourse=2.9.0-beta12
Discourse Discourse=2.9.0-beta13
Discourse Discourse=2.9.0-beta14
Discourse Discourse=2.9.0-beta2
Discourse Discourse=2.9.0-beta3
Discourse Discourse=2.9.0-beta4
Discourse Discourse=2.9.0-beta5
Discourse Discourse=2.9.0-beta6
Discourse Discourse=2.9.0-beta7
Discourse Discourse=2.9.0-beta8
Discourse Discourse=2.9.0-beta9
Discourse Discourse=3.0.0-beta15
Discourse Discourse=3.0.0-beta16
Discourse Discourse=3.1.0-beta1
Remediation
Patch Available
Event History
Jan 27, 2023
CVE Published
via MITRE·11:35 PM
Data Sourced
via MITRE·11:35 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2023-23624?
CVE-2023-23624 has a moderate severity level due to its potential to expose hidden topics based on tag filtering.
2
How do I fix CVE-2023-23624?
To fix CVE-2023-23624, upgrade to Discourse version 3.0.1 or higher on the stable branch or 3.1.0.beta2 on the beta branches.
3
What impact does CVE-2023-23624 have on Discourse forums?
CVE-2023-23624 allows users to exploit the exclude_tag parameter to infer hidden topics, posing a risk to user privacy.
4
Is CVE-2023-23624 present in all versions of Discourse?
CVE-2023-23624 affects Discourse versions prior to 3.0.1 on the stable branch and 3.1.0.beta2 on the beta branches.
5
Who is affected by CVE-2023-23624?
Any Discourse instances running vulnerable versions prior to the specified fixes are susceptible to the CVE-2023-23624 exploitation.