What is CVE-2023-43814?

CVE-2023-43814 is a low-severity vulnerability in Discourse, classified under Information Disclosure. CVSS score: 3.7/10. Published 2023-10-16.

How severe is CVE-2023-43814?

Low severity. CVSS v3 base score is 3.7 out of 10.

Information disclosure in Discourse

CVE-2023-43814

Discourse is an open source platform for community discussion. Attackers with details specific to a poll in a topic can use the `/polls/grouped_poll_results` endpoint to view the content of options in the poll and the number of votes for groups of poll participants. This impacts private polls where the results were intended to only be viewable by authorized users. This issue is patched in the 3.1.1 stable and 3.2.0.beta2 versions of Discourse. There is no workaround for this issue apart from upgrading to the fixed version.

Vulnerability class: Information Disclosure

EPSS: 0.003 (23.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

Discourse — versions beta <= 3.2.0.beta2, stable <= 3.1.1, 3.2.0

Weakness classification (CWE)

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2023-43814?: CVE-2023-43814 is a low-severity vulnerability in Discourse, classified under Information Disclosure. CVSS score: 3.7/10. Published 2023-10-16.
How severe is CVE-2023-43814?: Low severity. CVSS v3 base score is 3.7 out of 10.