What is CVE-2023-31142?

CVE-2023-31142 is a low-severity vulnerability in Discourse, classified under Incorrect Permission Assignment for Critical Resource. CVSS score: 2.0/10. Published 2023-06-13.

How severe is CVE-2023-31142?

Low severity. CVSS v3 base score is 2.0 out of 10.

Vulnerability in Discourse

CVE-2023-31142

Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches, if a site has modified their general category permissions, they could be set back to the default. This issue is patched in version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches. A workaround, only if you are modifying the general category permissions, is to use a new category for the same purpose.

EPSS: 0.003 (24.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 2.0 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N.

Affected products

Discourse — versions < 3.0.4, 3.1.0, >= 3.1.0.beta1, < 3.1.0.beta5

Weakness classification (CWE)

CWE-732 — Incorrect Permission Assignment for Critical Resource

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2023-31142?: CVE-2023-31142 is a low-severity vulnerability in Discourse, classified under Incorrect Permission Assignment for Critical Resource. CVSS score: 2.0/10. Published 2023-06-13.
How severe is CVE-2023-31142?: Low severity. CVSS v3 base score is 2.0 out of 10.