VulnerabilityModified

CVE-2023-45147

In affected versions any user can create a topic and add arbitrary custom fields to a topic.

LOW 3.1EPSS 0.27%

Does this matter?

Lower severity and a low EPSS score (0.27%). Track it; it rarely justifies an emergency change on its own.

Description

Discourse is an open source community platform. In affected versions any user can create a topic and add arbitrary custom fields to a topic. The severity of this vulnerability depends on what plugins are installed and how the plugins uses topic custom fields. For a default Discourse installation with the default plugins, this vulnerability has no impact. The problem has been patched in the latest version of Discourse. Users are advised to update to version 3.1.1 if they are on the stable branch or 3.2.0.beta2 if they are on the beta branch. Users unable to upgrade should disable any plugins that access topic custom fields.

CVSS 3.1: 3.1 LOWCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
EPSS: 0.27% probability · 19th percentile
CISA KEV: Not listed
Weakness: CWE-200
Affected: discourse/discourse
Source: security-advisories@github.com

References

https://github.com/discourse/discourse/security/advisories/GHSA-wm89-m359-f9qvVendor Advisory
https://github.com/discourse/discourse/security/advisories/GHSA-wm89-m359-f9qvVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.