CVE-2023-23622

Discourse is an open-source discussion platform. Prior to version 3.0.1 of the `stable` branch and version 3.1.0.beta2 of the `beta` and `tests-passed` branches, the count of topics displayed for a tag is a count of all regular topics regardless of whether the topic is in a read restricted category or not. As a result, any users can technically poll a sensitive tag to determine if a new topic is created in a category which the user does not have excess to. 

In version 3.0.1 of the `stable` branch and version 3.1.0.beta2 of the `beta` and `tests-passed` branches, the count of topics displayed for a tag defaults to only counting regular topics which are not in read restricted categories. Staff users will continue to see a count of all topics regardless of the topic's category read restrictions.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
GitHub_MCNA
4.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
CVEADP
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 46%
VendorProductVersion
discoursediscourse
𝑥
< 3.0.0
discoursediscourse
1.1.0:beta1
discoursediscourse
1.1.0:beta2
discoursediscourse
1.1.0:beta3
discoursediscourse
1.1.0:beta4
discoursediscourse
1.1.0:beta5
discoursediscourse
1.1.0:beta6
discoursediscourse
1.1.0:beta6b
discoursediscourse
1.1.0:beta7
discoursediscourse
1.1.0:beta8
discoursediscourse
1.2.0:beta1
discoursediscourse
1.2.0:beta2
discoursediscourse
1.2.0:beta3
discoursediscourse
1.2.0:beta4
discoursediscourse
1.2.0:beta5
discoursediscourse
1.2.0:beta6
discoursediscourse
1.2.0:beta7
discoursediscourse
1.2.0:beta8
discoursediscourse
1.2.0:beta9
discoursediscourse
1.3.0:beta1
discoursediscourse
1.3.0:beta10
discoursediscourse
1.3.0:beta11
discoursediscourse
1.3.0:beta2
discoursediscourse
1.3.0:beta3
discoursediscourse
1.3.0:beta4
discoursediscourse
1.3.0:beta5
discoursediscourse
1.3.0:beta6
discoursediscourse
1.3.0:beta7
discoursediscourse
1.3.0:beta8
discoursediscourse
1.3.0:beta9
discoursediscourse
1.4.0:beta1
discoursediscourse
1.4.0:beta10
discoursediscourse
1.4.0:beta11
discoursediscourse
1.4.0:beta12
discoursediscourse
1.4.0:beta2
discoursediscourse
1.4.0:beta3
discoursediscourse
1.4.0:beta4
discoursediscourse
1.4.0:beta5
discoursediscourse
1.4.0:beta6
discoursediscourse
1.4.0:beta7
discoursediscourse
1.4.0:beta8
discoursediscourse
1.4.0:beta9
discoursediscourse
1.5.0:beta1
discoursediscourse
1.5.0:beta10
discoursediscourse
1.5.0:beta11
discoursediscourse
1.5.0:beta12
discoursediscourse
1.5.0:beta13
discoursediscourse
1.5.0:beta13b
discoursediscourse
1.5.0:beta14
discoursediscourse
1.5.0:beta2
discoursediscourse
1.5.0:beta3
discoursediscourse
1.5.0:beta4
discoursediscourse
1.5.0:beta5
discoursediscourse
1.5.0:beta6
discoursediscourse
1.5.0:beta7
discoursediscourse
1.5.0:beta8
discoursediscourse
1.5.0:beta9
discoursediscourse
1.6.0:beta1
discoursediscourse
1.6.0:beta10
discoursediscourse
1.6.0:beta11
discoursediscourse
1.6.0:beta12
discoursediscourse
1.6.0:beta2
discoursediscourse
1.6.0:beta3
discoursediscourse
1.6.0:beta4
discoursediscourse
1.6.0:beta5
discoursediscourse
1.6.0:beta6
discoursediscourse
1.6.0:beta7
discoursediscourse
1.6.0:beta8
discoursediscourse
1.6.0:beta9
discoursediscourse
1.7.0:beta1
discoursediscourse
1.7.0:beta10
discoursediscourse
1.7.0:beta11
discoursediscourse
1.7.0:beta2
discoursediscourse
1.7.0:beta3
discoursediscourse
1.7.0:beta4
discoursediscourse
1.7.0:beta5
discoursediscourse
1.7.0:beta6
discoursediscourse
1.7.0:beta7
discoursediscourse
1.7.0:beta8
discoursediscourse
1.7.0:beta9
discoursediscourse
1.8.0:beta1
discoursediscourse
1.8.0:beta10
discoursediscourse
1.8.0:beta11
discoursediscourse
1.8.0:beta12
discoursediscourse
1.8.0:beta13
discoursediscourse
1.8.0:beta2
discoursediscourse
1.8.0:beta3
discoursediscourse
1.8.0:beta4
discoursediscourse
1.8.0:beta5
discoursediscourse
1.8.0:beta6
discoursediscourse
1.8.0:beta7
discoursediscourse
1.8.0:beta8
discoursediscourse
1.8.0:beta9
discoursediscourse
1.9.0:beta1
discoursediscourse
1.9.0:beta10
discoursediscourse
1.9.0:beta11
discoursediscourse
1.9.0:beta12
discoursediscourse
1.9.0:beta13
discoursediscourse
1.9.0:beta14
discoursediscourse
1.9.0:beta15
discoursediscourse
1.9.0:beta16
discoursediscourse
1.9.0:beta17
discoursediscourse
1.9.0:beta2
discoursediscourse
1.9.0:beta3
discoursediscourse
1.9.0:beta4
discoursediscourse
1.9.0:beta5
discoursediscourse
1.9.0:beta6
discoursediscourse
1.9.0:beta7
discoursediscourse
1.9.0:beta8
discoursediscourse
1.9.0:beta9
discoursediscourse
2.0.0:beta1
discoursediscourse
2.0.0:beta10
discoursediscourse
2.0.0:beta2
discoursediscourse
2.0.0:beta3
discoursediscourse
2.0.0:beta4
discoursediscourse
2.0.0:beta5
discoursediscourse
2.0.0:beta6
discoursediscourse
2.0.0:beta7
discoursediscourse
2.0.0:beta8
discoursediscourse
2.0.0:beta9
discoursediscourse
2.1.0:beta1
discoursediscourse
2.1.0:beta2
discoursediscourse
2.1.0:beta3
discoursediscourse
2.1.0:beta4
discoursediscourse
2.1.0:beta5
discoursediscourse
2.1.0:beta6
discoursediscourse
2.2.0:beta1
discoursediscourse
2.2.0:beta10
discoursediscourse
2.2.0:beta2
discoursediscourse
2.2.0:beta3
discoursediscourse
2.2.0:beta4
discoursediscourse
2.2.0:beta5
discoursediscourse
2.2.0:beta6
discoursediscourse
2.2.0:beta7
discoursediscourse
2.2.0:beta8
discoursediscourse
2.2.0:beta9
discoursediscourse
2.3.0:beta1
discoursediscourse
2.3.0:beta10
discoursediscourse
2.3.0:beta11
discoursediscourse
2.3.0:beta2
discoursediscourse
2.3.0:beta3
discoursediscourse
2.3.0:beta4
discoursediscourse
2.3.0:beta5
discoursediscourse
2.3.0:beta6
discoursediscourse
2.3.0:beta7
discoursediscourse
2.3.0:beta8
discoursediscourse
2.3.0:beta9
discoursediscourse
2.4.0:beta1
discoursediscourse
2.4.0:beta10
discoursediscourse
2.4.0:beta11
discoursediscourse
2.4.0:beta2
discoursediscourse
2.4.0:beta3
discoursediscourse
2.4.0:beta4
discoursediscourse
2.4.0:beta5
discoursediscourse
2.4.0:beta6
discoursediscourse
2.4.0:beta7
discoursediscourse
2.4.0:beta8
discoursediscourse
2.4.0:beta9
discoursediscourse
2.5.0:beta1
discoursediscourse
2.5.0:beta2
discoursediscourse
2.5.0:beta3
discoursediscourse
2.5.0:beta4
discoursediscourse
2.5.0:beta5
discoursediscourse
2.5.0:beta6
discoursediscourse
2.5.0:beta7
discoursediscourse
2.6.0:beta1
discoursediscourse
2.6.0:beta2
discoursediscourse
2.6.0:beta3
discoursediscourse
2.6.0:beta4
discoursediscourse
2.6.0:beta5
discoursediscourse
2.6.0:beta6
discoursediscourse
2.7.0:beta1
discoursediscourse
2.7.0:beta2
discoursediscourse
2.7.0:beta3
discoursediscourse
2.7.0:beta4
discoursediscourse
2.7.0:beta5
discoursediscourse
2.7.0:beta6
discoursediscourse
2.7.0:beta7
discoursediscourse
2.7.0:beta8
discoursediscourse
2.7.0:beta9
discoursediscourse
2.8.0:beta1
discoursediscourse
2.8.0:beta10
discoursediscourse
2.8.0:beta11
discoursediscourse
2.8.0:beta2
discoursediscourse
2.8.0:beta3
discoursediscourse
2.8.0:beta4
discoursediscourse
2.8.0:beta5
discoursediscourse
2.8.0:beta6
discoursediscourse
2.8.0:beta7
discoursediscourse
2.8.0:beta8
discoursediscourse
2.8.0:beta9
discoursediscourse
2.9.0:beta1
discoursediscourse
2.9.0:beta10
discoursediscourse
2.9.0:beta11
discoursediscourse
2.9.0:beta12
discoursediscourse
2.9.0:beta13
discoursediscourse
2.9.0:beta14
discoursediscourse
2.9.0:beta2
discoursediscourse
2.9.0:beta3
discoursediscourse
2.9.0:beta4
discoursediscourse
2.9.0:beta5
discoursediscourse
2.9.0:beta6
discoursediscourse
2.9.0:beta7
discoursediscourse
2.9.0:beta8
discoursediscourse
2.9.0:beta9
discoursediscourse
3.0.0:beta15
discoursediscourse
3.0.0:beta16
𝑥
= Vulnerable software versions