CVE-2023-45131CWE-200

Unauthenticated access to new private chat messages in Discourse

High · published October 16, 2023

CVSS v3.1
7.5
EPSS
4%
Percentile
89.7
In the wild
Unconfirmed
What it is

Discourse is an open source platform for community discussion. New chat messages can be read by making an unauthenticated POST request to MessageBus. This issue is patched in the 3.1.1 stable and 3.2.0.beta2 versions of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.03719 · 89.7th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2023-10-16T21:24Z
EPSS history
Timeline
  • 16 OCT 21:24Z
    Unauthenticated access to new private chat messages in Discourse
    cvelistv5