CVE-2023-49098 Reaction data for user notifications exposed in Discourse-reactions
Attackers can access private reaction notification data for users in the Discourse-reactions plugin, compromising user privacy.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-49098?
CVE-2023-49098 is a low-severity vulnerability in discourse-reactions, published on 12 Jan 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Discourse-reactions is a plugin that allows user to add their reactions to the post. Data about a user's reaction notifications could be exposed. This vulnerability was patched in commit 2c26939.
Weakness: CWE-284
Which versions are affected by CVE-2023-49098?
It affects 1 product.
Products include Discourse Discourse Reactions.
How do I fix CVE-2023-49098?
No fix has been published for CVE-2023-49098 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-49098 being exploited?
There is no known exploitation of CVE-2023-49098 in the wild and no public exploit code.
Other vulnerabilities in discourse-reactions
Sources
Also known as GHSA-mq82-7v5x-rhv8.