What is CVE-2023-43814?

CVE-2023-43814 is a vulnerability in the Discourse open source platform that allows attackers to view the content of options and number of votes in a poll.

What is the severity of CVE-2023-43814?

CVE-2023-43814 has a severity rating of low (3.7).

How does CVE-2023-43814 impact private polls?

CVE-2023-43814 specifically impacts private polls where the attacker has specific details about a poll in a topic.

Which versions of Discourse are affected by CVE-2023-43814?

Versions up to and including 3.1.1 of Discourse stable, and version 3.2.0-beta1 of Discourse beta are affected by CVE-2023-43814.

Is there a fix for CVE-2023-43814?

Yes, upgrading to a patched version of Discourse is recommended to fix CVE-2023-43814.

Vulnerability/
CVE-2023-43814

low

3.7

CWE

200 284

16/10/2023

13/9/2024

CVE-2023-43814: Exposure of poll options and votes to unauthorized users in Discourse

First published: Mon Oct 16 2023(Updated: )

Discourse is an open source platform for community discussion. Attackers with details specific to a poll in a topic can use the `/polls/grouped_poll_results` endpoint to view the content of options in the poll and the number of votes for groups of poll participants. This impacts private polls where the results were intended to only be viewable by authorized users. This issue is patched in the 3.1.1 stable and 3.2.0.beta2 versions of Discourse. There is no workaround for this issue apart from upgrading to the fixed version.

Credit: security-advisories@github.com security-advisories@github.com

Affected Software	Affected Version	How to fix
Discourse Discourse	<=3.1.1
Discourse Discourse	=3.2.0-beta1

Never miss a vulnerability like this again

Reference Links

https://github.com/discourse/discourse/security/advisories/GHSA-3x57-846g-7qcw

Frequently Asked Questions

What is CVE-2023-43814?
CVE-2023-43814 is a vulnerability in the Discourse open source platform that allows attackers to view the content of options and number of votes in a poll.
What is the severity of CVE-2023-43814?
CVE-2023-43814 has a severity rating of low (3.7).
How does CVE-2023-43814 impact private polls?
CVE-2023-43814 specifically impacts private polls where the attacker has specific details about a poll in a topic.
Which versions of Discourse are affected by CVE-2023-43814?
Versions up to and including 3.1.1 of Discourse stable, and version 3.2.0-beta1 of Discourse beta are affected by CVE-2023-43814.
Is there a fix for CVE-2023-43814?
Yes, upgrading to a patched version of Discourse is recommended to fix CVE-2023-43814.

collector/nvd-api
collector/nvd-index
agent/type
agent/author
agent/softwarecombine
collector/mitre-cve
source/MITRE
agent/references
agent/title
agent/severity
agent/last-modified-date
agent/weakness
agent/tags
agent/description
agent/first-publish-date
agent/event
vendor/discourse
canonical/discourse discourse
version/discourse discourse/3.1.1
version/discourse discourse/3.2.0-beta1

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.