{"id":"CVE-2023-36466","state":"PUBLISHED","title":"Topic Title Validation Skipped When Changing Category in Discourse","description":"Discourse is an open source discussion platform. When editing a topic, there is a vulnerability that enables a user to bypass the topic title validations for things like title length, number of emojis in title and blank topic titles. The issue is patched in the latest stable, beta and tests-passed version of Discourse.\n","publishedAt":"2023-07-14T21:14:01.476Z","updatedAt":"2024-10-22T13:58:48.183Z","severity":{"score":3.5,"label":"Low","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","source":"GitHub_M"},"assigner":"GitHub_M","products":["discourse discourse"],"affected":[{"vendor":"discourse","product":"discourse","versions":[{"version":"stable < 3.0.5","status":"affected"},{"version":"beta < 3.1.0.beta6","status":"affected"},{"version":"tests-passed < 3.1.0.beta6","status":"affected"}]}],"references":["https://github.com/discourse/discourse/security/advisories/GHSA-4hjh-wg43-p932"],"weaknesses":["CWE-20"],"ingestedAt":"2026-10-29T20:06:08.715Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/36xxx/CVE-2023-36466.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-36466","state":"PUBLISHED","datePublished":"2023-07-14T21:14:01.476Z","dateUpdated":"2024-10-22T13:58:48.183Z","assignerShortName":"GitHub_M","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateReserved":"2023-06-21T18:50:41.700Z"},"containers":{"cna":{"title":"Topic Title Validation Skipped When Changing Category in Discourse","descriptions":[{"lang":"en","value":"Discourse is an open source discussion platform. When editing a topic, there is a vulnerability that enables a user to bypass the topic title validations for things like title length, number of emojis in title and blank topic titles. The issue is patched in the latest stable, beta and tests-passed version of Discourse.\n"}],"affected":[{"vendor":"discourse","product":"discourse","versions":[{"version":"stable < 3.0.5","status":"affected"},{"version":"beta < 3.1.0.beta6","status":"affected"},{"version":"tests-passed < 3.1.0.beta6","status":"affected"}]}],"references":[{"url":"https://github.com/discourse/discourse/security/advisories/GHSA-4hjh-wg43-p932","name":"https://github.com/discourse/discourse/security/advisories/GHSA-4hjh-wg43-p932","tags":["x_refsource_CONFIRM"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-20","lang":"en","description":"CWE-20: Improper Input Validation","type":"CWE"}]}],"providerMetadata":{"shortName":"GitHub_M","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateUpdated":"2023-07-14T21:14:01.476Z"},"source":{"advisory":"GHSA-4hjh-wg43-p932","discovery":"UNKNOWN"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://github.com/discourse/discourse/security/advisories/GHSA-4hjh-wg43-p932","name":"https://github.com/discourse/discourse/security/advisories/GHSA-4hjh-wg43-p932","tags":["x_refsource_CONFIRM","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T16:45:56.979Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-10-22T13:51:27.892562Z","id":"CVE-2023-36466","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-10-22T13:58:48.183Z"}}]}}}