CVE-2023-45147

Arbitrary keys can be added to a topic's custom fields by any user in Discourse

State: Published
Severity: 4.9 Medium
Published: Oct 16, 2023
Updated: Sep 13, 2024
Reserved: Oct 4, 2023

Description

Discourse is an open source community platform. In affected versions any user can create a topic and add arbitrary custom fields to a topic. The severity of this vulnerability depends on what plugins are installed and how the plugins uses topic custom fields. For a default Discourse installation with the default plugins, this vulnerability has no impact. The problem has been patched in the latest version of Discourse. Users are advised to update to version 3.1.1 if they are on the stable branch or 3.2.0.beta2 if they are on the beta branch. Users unable to upgrade should disable any plugins that access topic custom fields.

Scores

CVSS	Score	Vector	Source
3.1	4.9 Medium	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N	GitHub_M

Weaknesses

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

Product	Versions
discoursediscourse	<= 3.1.1Affected beta: <= 3.2.0.beta2Affected

References

https://github.com/discourse/discourse/security/advisories/GHSA-wm89-m359-f9qv

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.