CVE-2023-45816: Unread bookmark reminder notifications that the user cannot access can be seen
First published: Fri Nov 10 2023(Updated: )
Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, there is an edge case where a bookmark reminder is sent and an unread notification is generated, but the underlying bookmarkable (e.g. post, topic, chat message) security has changed, making it so the user can no longer access the underlying resource. As of version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, bookmark reminders are now no longer sent if the user does not have access to the underlying bookmarkable, and also the unread bookmark notifications are always filtered by access. There are no known workarounds.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| <3.1.3 | ||
| <3.2.0 | ||
| =3.2.0-beta1 | ||
| =3.2.0-beta2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-45816.
What is the title of the vulnerability?
The title of the vulnerability is 'Unread bookmark reminder notifications that the user cannot access can be seen'.
What is the severity of CVE-2023-45816?
The severity of CVE-2023-45816 is low (3.3).
Which versions of Discourse are affected by CVE-2023-45816?
Discourse versions up to 3.1.3 in the stable branch and up to 3.2.0 in the beta and tests-passed branches are affected.
How can I fix the vulnerability?
To fix the vulnerability, update to version 3.1.3 of the stable branch or version 3.2.0 of the beta and tests-passed branches of Discourse.
- agent/type
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/references
- agent/title
- agent/first-publish-date
- agent/author
- agent/description
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- agent/event
- vendor/discourse
- canonical/discourse discourse
- version/discourse discourse/3.2.0-beta1
- version/discourse discourse/3.2.0-beta2