CVE-2023-38684

Katalog CVE

CVSS 7.5 · High EPSS 0,64%

Kerentanan Allocation of Resources Without Limits or Throttling pada discourse. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, in multiple controller actions, Discourse accepts limit params but does not impose any upper bound on the values being accepted. Without an upper bound, the software may allow arbitrary users to generate DB queries which may end up exhausting the resources on the server. The issue is patched in version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches. There are no known workarounds for this vulnerability.

Rincian

Terbit di NVD

28 Juli 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,64% peluang dieksploitasi; lebih tinggi dari 49,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 212 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• https://github.com/discourse/discourse/security/advisories/GHSA-ff7g-xv79-hgmf advisory vendor
• https://github.com/discourse/discourse/commit/bfc3132bb22bd5b7e86f428746b89c4d3d7f5a70 patch