CVE-2023-38498

Katalog CVE

CVSS 6.5 · Medium EPSS 0,70%

Kerentanan Uncontrolled Resource Consumption pada discourse. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, a malicious user can prevent the defer queue from proceeding promptly on sites hosted in the same multisite installation. The issue is patched in version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches. There are no known workarounds for this vulnerability. Users of multisite configurations should upgrade.

Rincian

Terbit di NVD

28 Juli 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption
CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,70% peluang dieksploitasi; lebih tinggi dari 51,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 212 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• https://github.com/discourse/discourse/security/advisories/GHSA-wv29-rm3f-4g2j advisory vendor
• https://github.com/discourse/discourse/commit/26e267478d785e2f32ee7da4613e2cf4a65ff182 patch