CVE-2023-25819

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Discourse is an open source platform for community discussion. Tags that are normally private are showing in metadata. This affects any site running the `tests-passed` or `beta` branches >= 3.1.0.beta2. The issue is patched in the latest `beta` and `tests-passed` version of Discourse.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-359CWE-200

Affected software

VendorProductVersions
discoursediscourse< 3.1.0.beta3

References

Timeline

Published
Mar 4, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-25826.1A prototype pollution vulnerability exists in Strikingly CMS which can result in reflected cross-site scripting (XSS) in affected applicatioCVE-2023-258207.8Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Enterprise Server is the enteCVE-2023-258217.5Nextcloud is an Open Source private cloud software. Versions 24.0.4 and above, prior to 24.0.7, and 25.0.0 and above, prior to 25.0.1, contaCVE-2023-258226.5ReportPortal is an AI-powered test automation platform. Prior to version 5.10.0 of the `com.epam.reportportal:service-api` module, corresponCVE-2023-258239.8Gradio is an open-source Python library to build machine learning and data science demos and web applications. Versions prior to 3.13.1 contCVE-2023-258247.5Mod_gnutls is a TLS module for Apache HTTPD based on GnuTLS. Versions from 0.9.0 to 0.12.0 (including) did not properly fail blocking read oCVE-2023-258256.1ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. VersioCVE-2023-258269.8Due to insufficient validation of parameters passed to the legacy HTTP query API, it is possible to inject crafted OS commands into multipleCVE-2023-258276.1Due to insufficient validation of parameters reflected in error messages by the legacy HTTP query API and the logging endpoint, it is possibCVE-2023-258287.2Pluck CMS is vulnerable to an authenticated remote code execution (RCE) vulnerability through its “albums” module. Albums are used to createCVE-2023-258296.1There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.0 and below that may allow a remote, unauthenticated attacker toCVE-2023-258310.0Code Injection in GitHub repository jsreport/jsreport prior to 3.11.3.