VYPR
← All advisories
Medium severity4.9NVD Advisory· Published Oct 16, 2023· Updated Jun 17, 2026

CVE-2023-45147

CVE-2023-45147

Description

Discourse is an open source community platform. In affected versions any user can create a topic and add arbitrary custom fields to a topic. The severity of this vulnerability depends on what plugins are installed and how the plugins uses topic custom fields. For a default Discourse installation with the default plugins, this vulnerability has no impact. The problem has been patched in the latest version of Discourse. Users are advised to update to version 3.1.1 if they are on the stable branch or 3.2.0.beta2 if they are on the beta branch. Users unable to upgrade should disable any plugins that access topic custom fields.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

5
  • Discourse (software)/Discourse4 versions
    cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*+ 3 more
    • cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*range: <=3.1.1
    • cpe:2.3:a:discourse:discourse:3.2.0:beta1:*:*:beta:*:*:*
    • (no CPE)range: up to 3.1.1 (stable) or 3.2.0.beta2 (beta)
    • (no CPE)range: <= 3.1.1
  • osv-coords
    pkg:bitnami/discourse
    Range: <= 3.1.1

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.