Discourse Race Condition in Accept Invite (CVE-2023-37904)

Résumé

Discourse Race Condition in Accept Invite

Description d'origine

La description telle que publiée par la source (souvent en anglais).

Discourse is an open source discussion platform. Prior to version 3.0.6 of the stable branch and version 3.1.0.beta7 of the beta and tests-passed branches, more users than permitted could be created from invite links. The issue is patched in version 3.0.6 of the stable branch and version 3.1.0.beta7 of the beta and tests-passed branches. As a workaround, use restrict to email address invites.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Paquets affectés

Bitnami discourse

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.6"}]}]

Références

advisory github.com
patch github.com
web nvd.nist.gov