CVE-2023-36466CWE-20

Topic Title Validation Skipped When Changing Category in Discourse

Low · published July 14, 2023

CVSS v3.1
3.5
EPSS
0%
Percentile
32.9
In the wild
Unconfirmed
What it is

Discourse is an open source discussion platform. When editing a topic, there is a vulnerability that enables a user to bypass the topic title validations for things like title length, number of emojis in title and blank topic titles. The issue is patched in the latest stable, beta and tests-passed version of Discourse.

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00398 · 32.9th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2023-07-14T21:14Z
EPSS history
Timeline
  • 14 JUL 21:14Z
    Topic Title Validation Skipped When Changing Category in Discourse
    cvelistv5