CVE-2023-30611

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Discourse-reactions is a plugin that allows user to add their reactions to the post in the Discourse messaging platform. In affected versions data about what reactions were performed on a post in a private topic could be leaked. This issue has been addressed in version 0.3. Users are advised to upgrade. Users unable to upgrade should disable the discourse-reactions plugin to fully mitigate the issue.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
discourse	discourse-reactions	>= 0.2, < 0.3

References

Timeline

Published: Apr 19, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-306124.9Cloud hypervisor is a Virtual Machine Monitor for Cloud workloads. This vulnerability allows users to close arbitrary open file descriptors CVE-2023-306139.0Kiwi TCMS, an open source test management system, allows users to upload attachments to test plans, test cases, etc. In versions of Kiwi TCM CVE-2023-306146.1Pay is a payments engine for Ruby on Rails 6.0 and higher. In versions prior to 6.3.2 a payments info page of Pay is susceptible to reflecte CVE-2023-306155.4Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. A stored Cross-Site CVE-2023-306166.5Form block is a wordpress plugin designed to make form creation easier. Versions prior to 1.0.2 are subject to a Cross-Site Request Forgery CVE-2023-306176.5Kruise provides automated management of large-scale applications on Kubernetes. Starting in version 0.8.0 and prior to versions 1.3.1, 1.4.1 CVE-2023-306183.3Kitchen-Terraform provides a set of Test Kitchen plugins which enable the use of Test Kitchen to converge a Terraform configuration and veri CVE-2023-306195.4Tuleap Open ALM is a Libre and Open Source tool for end to end traceability of application and system developments. The title of an artifact CVE-2023-30629.8A vulnerability was found in code-projects Agro-School Management System 1.0. It has been classified as critical. Affected is an unknown fun CVE-2023-306207.5mindsdb is a Machine Learning platform to help developers build AI solutions. In affected versions an unsafe extraction is being performed u CVE-2023-306219.8Gipsy is a multi-purpose discord bot which aim to be as modular and user-friendly as possible. In versions prior to 1.3 users can run comman CVE-2023-306228.8Clusternet is a general-purpose system for controlling Kubernetes clusters across different environments. An issue in clusternet prior to ve