CVE-2023-23616

Katalog CVE

CVSS 4.3 · Medium EPSS 0,68%

Kerentanan Uncontrolled Resource Consumption pada discourse. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and 3.1.0.beta2 on the `beta` and `tests-passed` branches, when submitting a membership request, there is no character limit for the reason provided with the request. This could potentially allow a user to flood the database with a large amount of data. However it is unlikely this could be used as part of a DoS attack, as the paths reading back the reasons are only available to administrators. Starting in version 3.0.1 on the `stable` branch and 3.1.0.beta2 on the `beta` and `tests-passed` branches, a limit of 280 characters has been introduced for membership requests.

Rincian

Terbit di NVD

28 Januari 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption

EPSS (30 hari)

0,68% peluang dieksploitasi; lebih tinggi dari 51,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 208 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• https://github.com/discourse/discourse/commit/3e0cc4a5d9ef44ad902f6985d046ebb32f0a14ee patch · advisory pihak ketiga
• https://github.com/discourse/discourse/commit/d5745d34c20c31a221039d8913f33064433003ea patch · advisory pihak ketiga
• https://github.com/discourse/discourse/pull/19993 patch · advisory pihak ketiga
• https://github.com/discourse/discourse/security/advisories/GHSA-6xff-p329-9pgf advisory pihak ketiga