CVE-2024-38360

Katalog CVE

CVSS 4.9 · Medium EPSS 0,47%

Kerentanan Uncontrolled Resource Consumption pada discourse. Skor CVSS 3.1 4.9 (Medium) menurut github.com.

Deskripsi (NVD)

Discourse is an open source platform for community discussion. In affected versions by creating replacement words with an almost unlimited number of characters, a moderator can reduce the availability of a Discourse instance. This issue has been addressed in stable version 3.2.3 and in current betas. Users are advised to upgrade. Users unable to upgrade may manually remove the long watched words either via SQL or Rails console.

Rincian

Terbit di NVD

15 Juli 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.9 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption

EPSS (30 hari)

0,47% peluang dieksploitasi; lebih tinggi dari 38,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/discourse/discourse/security/advisories/GHSA-68pm-hm8x-pq2p advisory vendor
• https://github.com/discourse/discourse/commit/7b53e610c17e38be982dffefa4e5b5a709a3b990 patch