Discourse vulnerable to exposure of user post counts per top… (CVE-2023-22453)

Summary

Discourse vulnerable to exposure of user post counts per topic to unauthorized users

Original description

The description as published by the source.

Discourse is an option source discussion platform. Prior to version 2.8.14 on the stable branch and version 3.0.0.beta16 on the beta and tests-passed branches, the number of times a user posted in an arbitrary topic is exposed to unauthorized users through the /u/username.json endpoint. The issue is patched in version 2.8.14 and 3.0.0.beta16. There is no known workaround.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Affected packages

Bitnami discourse

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.8.14"}]}]

References

advisory github.com
advisory github.com
web nvd.nist.gov