CVE-2023-36466

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Discourse is an open source discussion platform. When editing a topic, there is a vulnerability that enables a user to bypass the topic title validations for things like title length, number of emojis in title and blank topic titles. The issue is patched in the latest stable, beta and tests-passed version of Discourse.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-20CWE-287

Affected software

No affected versions have been published.

Timeline

Published
Jul 14, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-364678.8AWS data.all is an open source development framework to help users build a data marketplace on Amazon Web Services. data.all versions 1.2.0 CVE-2023-364688.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When an XWiki installation is upgraCVE-2023-364698.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can edit their own useCVE-2023-36474.8The IURNY by INDIGITALL WordPress plugin before 3.2.3 does not sanitise and escape some of its settings, which could allow high privilege usCVE-2023-364708.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By either creating a new or editingCVE-2023-364715.4Xwiki commons is the common modules used by other XWiki top level projects. The HTML sanitizer that is included in XWiki since version 14.6RCVE-2023-364725.7Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset pasCVE-2023-364736.1Discourse is an open source discussion platform. A CSP (Content Security Policy) nonce reuse vulnerability could allow XSS attacks to bypassCVE-2023-364746.1Interactsh is an open-source tool for detecting out-of-band interactions. Domains configured with interactsh server prior to version 1.0.0 wCVE-2023-364759.8Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 5.5.2 and 6.2.1, aCVE-2023-364765.5calamares-nixos-extensions provides Calamares branding and modules for NixOS, a distribution of GNU/Linux. Users of calamares-nixos-extensioCVE-2023-364775.4XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit rights can edit
CVE-2023-36466: Medium severity, CVSS 4.3 | Vulnix