CVE-2023-25169

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

discourse-yearly-review is a discourse plugin which publishes an automated Year in Review topic. In affected versions a user present in a yearly review topic that is then anonymised will still have some data linked to its original account. This issue has been patched in commit `b3ab33bbf7` which is included in the latest version of the Discourse Yearly Review plugin. Users are advised to upgrade. Users unable to upgrade may disable the `yearly_review_enabled` setting to fully mitigate the issue. Also, it's possible to edit the anonymised user's old data in the yearly review topics manually.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Mar 6, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-25174.3The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and includingCVE-2023-251708.8PrestaShop is an open source e-commerce web application that, prior to version 8.0.1, is vulnerable to cross-site request forgery (CSRF). WhCVE-2023-251715.9Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt denCVE-2023-251725.4Discourse is an open-source discussion platform. Prior to version 3.0.1 of the `stable` branch and version 3.1.0.beta2 of the `beta` and `teCVE-2023-251737.8containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and 1.5.18 where supplementary groupsCVE-2023-251747.8Improper access control in some Intel(R) Chipset Driver Software before version 10.1.19444.8378 may allow an authenticated user to potentialCVE-2023-251755.5Improper input validation in some Intel(R) Server Board BMC firmware before version 2.90 may allow a privileged user to enable information dCVE-2023-251765.5in OpenHarmony v3.2.4 and prior versions allow a local attacker cause information leak through out-of-bounds Read.CVE-2023-251777.8Delta Electronics' CNCSoft-B DOPSoft versions 1.0.0.4 and prior are vulnerable to stack-based buffer overflow, which could allow an attackeCVE-2023-251789.8Controller may be loaded with malicious firmware which could enable remote code execution. See Honeywell Security Notification for recommendCVE-2023-251795.5Uncontrolled resource consumption in the Intel(R) Unite(R) android application before Release 17 may allow an authenticated user to potentiaCVE-2023-25186.1The Easy Forms for Mailchimp WordPress plugin before 6.8.9 does not sanitise and escape a parameter before outputting it back in the page wh
CVE-2023-25169: Medium severity, CVSS 5.3 | Vulnix