Medium severity · published Apr 19, 2023
CVE-2023-30611
Discourse-reactions is a plugin that allows user to add their reactions to the post in the Discourse messaging platform
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
Discourse-reactions is a plugin that allows user to add their reactions to the post in the Discourse messaging platform. In affected versions data about what reactions were performed on a post in a private topic could be leaked. This issue has been addressed in version 0.3. Users are advised to upgrade. Users unable to upgrade should disable the discourse-reactions plugin to fully mitigate the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
Reactions · Discourse
0.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-30611
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-30611
Patch
https://github.com/discourse/discourse-reactions/commit/01aca15b2774c088f3673118e92e9469f37d2fb6
Vendor Advisory
https://github.com/discourse/discourse-reactions/security/advisories/GHSA-4cgc-c7vh-94g6