CVE-2023-22453

MEDIUM5.3EPSS 0.27%

Discourse vulnerable to exposure of user post counts per topic to unauthorized users

Published: 3/6/2024Modified: 10/15/2025

Also known as:GHSA-xx97-6494-p2rvBIT-discourse-2023-22453

Description

Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 3.0.0.beta16 on the `beta` and `tests-passed` branches, the number of times a user posted in an arbitrary topic is exposed to unauthorized users through the `/u/username.json` endpoint. The issue is patched in version 2.8.14 and 3.0.0.beta16. There is no known workaround.

Affected packages (1)

Bitnami/discoursefrom 0, < 2.8.14

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References (3)

WEBhttps://github.com/discourse/discourse/commit/cbcf8a064b4889a19c991641e09c399bfa1ef2ad
WEBhttps://github.com/discourse/discourse/security/advisories/GHSA-xx97-6494-p2rv
WEBhttps://nvd.nist.gov/vuln/detail/CVE-2023-22453