BIT-discourse-2023-38706

vendorUSosv

Discourse vulnerable to DoS via drafts

view advisory published 2024-03-06Licence: per source

Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch, a malicious user can create an unlimited number of drafts with very long draft keys which may end up exhausting the resources on the server. The issue is patched in version 3.1.1 of the `stable` branch. There are no known workarounds.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-38706US	medium6.5	0.77% (55th)	—	2023-09-15
Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branches, a malicious user c…

references

External citations — patches, advisories, analysis.

https://github.com/discourse/discourse/security/advisories/GHSA-7wpp-4pqg-gvp8ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2023-38706WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan