Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, more users than permitted could be created from invite links. The issue is patched in version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches. As a workaround, use restrict to email address invites.
Metrics
No CVSS v4.0
Attack Vector Network
Attack Complexity High
Privileges Required Low
Scope Unchanged
Confidentiality Impact Low
Integrity Impact None
Availability Impact None
User Interaction Required
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploitation none
Automatable no
Technical Impact partial
Affected Vendors & Products
Vendors | Products |
---|---|
Discourse |
|
Configuration 1 [-]
|
No data.
References
History
Fri, 11 Oct 2024 21:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
ssvc
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published: 2023-07-28T15:09:08.049Z
Updated: 2024-10-10T16:05:21.191Z
Reserved: 2023-07-10T17:51:29.610Z
Link: CVE-2023-37904
Vulnrichment
Updated: 2024-08-02T17:23:27.669Z
NVD
Status : Modified
Published: 2023-07-28T16:15:11.617
Modified: 2024-11-21T08:12:26.150
Link: CVE-2023-37904
Redhat
No data.