CVE-2023-37904 LOW

CVE-2023-37904: Discourse Race Condition in Accept Invite

Vendor Discourse
Product discourse
Weakness CWE-362
Published July 28, 2023
Last update October 10, 2024

CVSS base score

2.6/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction Required
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, more users than permitted could be created from invite links. The issue is patched in version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches. As a workaround, use restrict to email address invites.

Key dates

02Disclosure timeline

July 28, 2023 CVE published
October 10, 2024 Record updated