CVE-2023-37904

Discourse Race Condition in Accept Invite

Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, more users than permitted could be created from invite links. The issue is patched in version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches. As a workaround, use restrict to email address invites.

We have discovered 575 live websites that are affected by CVE-2023-37904.

Run a Free Instant Scan



Affected Software

Product  Discourse
Category Message Boards
Vulnerable Domains575 live websites (14% of Discourse install base)
Vulnerable Versions
  • from 0 through 3.0.6
  • from 3.1 through 3.1
Vulnerable Versions Count24 versions ( 33% of all versions)


Common Weakness Enumeration

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')



Details

  • Published - Jul 28, 2023
  • Updated - Oct 10, 2024

Website Distribution by Country

Number of websites using CVE-2023-37904
United States370 websites


Germany59 websites
France26 websites
Singapore14 websites
China12 websites
Brazil9 websites
Switzerland7 websites
Canada6 websites
Russia6 websites
GB5 websites

Website Distribution by TLD

Number of websites using CVE-2023-37904
.com241 websites
.org95 websites
.io28 websites
.net22 websites
.de14 websites
.co8 websites
.cn7 websites
.fr7 websites
.info6 websites
.com.br5 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2023-37904

Top websites that are affected by CVE-2023-37904. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
******.********.com United States**,***
*********.**********.de Germany***,***
*********.**********.io United States***,***
***.***********.org Germany***,***
***********.net United States***,***
*****.***********.com United States***,***
*************.com United States***,***
********.com United States***,***
*****.com United States***,***
**********.org United States***,***
See full domain list

FAQ

CVE-2023-37904 is Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in Discourse
A total of 575 websites have been identified as vulnerable to CVE-2023-37904, based on global website indexing conducted by WebTechSurvey.
The Discourse is affected by the CVE-2023-37904 vulnerability.
Discourse versions up to 3.1 are vulnerable to CVE-2023-37904.
CVE-2023-37904 is resolved in version 3.1 of Discourse.