CVE-2023-46241
CVSS 3.1 Score 9.0 of 10 (high)
Details
Summary
CVE-2023-46241 is a vulnerability affecting the `discourse-microsoft-auth` plugin in Discourse, an open-source platform for community discussion. This plugin enables authentication via Microsoft, and sites using it are susceptible to account takeover attacks. The issue lies in the configuration settings for application accounts, specifically those set to "Accounts in this organizational directory or personal Microsoft accounts" or "Public sign up". The vulnerability has been addressed with commit c40665f44509724b64938c85def9fb2e79f62ec8 in the plugin, and a `microsoft_auth:revoke` rake task has been added to revoke API keys, log out users, and remove their connection records to Microsoft. As a temporary solution, sites can disable the `discourse-microsoft-auth` plugin or run the `microsoft_auth:log_out_users` rake task to log out associated users.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions