Discourse Reactions <0.3: Private Topic Reaction Leakage (CVE-2023-30611)
CVE-2023-30611 Published on April 19, 2023
Discourse-reactions is a plugin that allows user to add their reactions to the post in the Discourse messaging platform. In affected versions data about what reactions were performed on a post in a private topic could be leaked. This issue has been addressed in version 0.3. Users are advised to upgrade. Users unable to upgrade should disable the discourse-reactions plugin to fully mitigate the issue.
Vulnerability Analysis
CVE-2023-30611 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a small impact on integrity and availability.
Weakness Type
What is an Information Disclosure Vulnerability?
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVE-2023-30611 has been classified to as an Information Disclosure vulnerability or weakness.
Products Associated with CVE-2023-30611
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2023-30611 are published in Discourse Reactions:
Affected Versions
discourse-reactions Version >= 0.2, < 0.3 is affected by CVE-2023-30611Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.