Discourse Reactions Plugin Notification Data Exposure (CVE202349098)
CVE-2023-49098 Published on January 12, 2024
Reaction data for user notifications exposed in Discourse-reactions
Discourse-reactions is a plugin that allows user to add their reactions to the post. Data about a user's reaction notifications could be exposed. This vulnerability was patched in commit 2c26939.
Vulnerability Analysis
CVE-2023-49098 is exploitable with network access, requires user interaction and a small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a small impact on integrity and availability.
Weakness Type
What is an Authorization Vulnerability?
The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVE-2023-49098 has been classified to as an Authorization vulnerability or weakness.
Products Associated with CVE-2023-49098
stack.watch emails you whenever new vulnerabilities are published in Discourse Reactions or Discourse. Just hit a watch button to start following.
Affected Versions
discourse-reactions Version < commit 2c26939 is affected by CVE-2023-49098Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.