CVE-2023-23615CWE-284

Malicious users in Discourse can create spam topics as any user due to improper access control

Medium · published February 3, 2023

CVSS v3.1
5.3
EPSS
0%
Percentile
38.3
In the wild
Unconfirmed
What it is

Discourse is an open source discussion platform. The embeddable comments can be exploited to create new topics as any user but without any clear title or content. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. As a workaround, disable embeddable comments by deleting all embeddable hosts.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00452 · 38.3th percentile
Weakness
CWE-284 · Improper Access Control
Published
2023-02-03T21:57Z
EPSS history
Timeline
  • 03 FEB 21:57Z
    Malicious users in Discourse can create spam topics as any user due to improper access control
    cvelistv5