CVE-2023-25819: Discourse tags with no visibility are leaking into og:article:tag
Published Mar 4, 2023
·Updated
Discourse is an open source platform for community discussion. Tags that are normally private are showing in metadata. This affects any site running the tests-passed or beta branches >= 3.1.0.beta2. The issue is patched in the latest beta and tests-passed version of Discourse.
Affected Software
3 affected components
Discourse Discourse<3.1.0
Discourse Discourse=3.1.0-beta1
Discourse Discourse=3.1.0-beta2
Remediation
Event History
Mar 4, 2023
CVE Published
via MITRE·12:11 AM
Data Sourced
via MITRE·12:11 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2023-25819.
2
What is Discourse?
Discourse is an open source platform for community discussion.
3
Which branches of Discourse are affected by the vulnerability?
The `tests-passed` and `beta` branches >= 3.1.0.beta2 are affected.
4
How can I fix the vulnerability?
Update to the latest `beta` or `tests-passed` version of Discourse where this issue is patched.
5
What is the severity of CVE-2023-25819?
The severity of CVE-2023-25819 is medium with a CVSS score of 5.3.