CVE-2023-23621

highPriorität · verfolgen · 30EPSS 0.009 · 59. PerzentilEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.87% (59th) EPSS

CVSS 7.5 · high

Is it mine?

27 products

Prüfe deine Angriffsfläche

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · bewertet 2026-10-27

Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and version 3.1.0.beta2 on the `beta` and `tests-passed` branches, a malicious user can cause a regular expression denial of service using a carefully crafted user agent. This issue is patched in version 3.0.1 on the `stable` branch and version 3.1.0.beta2 on the `beta` and `tests-passed` branches. There are no known workarounds.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

8.6

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 6.9–8.6

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 3.6

v3.18.6highAV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU

v3.18.6highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:Hsecondary · ENISA EU

v3.18.6highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:Hsecondary · security-advisories@github.comAusnutzbarkeit 3.9 · Auswirkung 4

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-1333USprimärCWE-1333USCWE-185US

betroffene Produkte (27)

Betroffene Produkte und Versionsbereiche.

discourse discourse≤ < 3.0.1enisa_euvdEU
discourse discourse≤ = 3.1.0.beta1enisa_euvdEU
Civilized Discourse Construction Kit, Inc. Discourse≤ 3.1.0.beta2fstec_bduRU
Civilized Discourse Construction Kit, Inc. Discourse≤ 3.0.1 stablefstec_bduRU
discourse discourse< 3.0.1nvdUScpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*
discourse discourse= 1.1.0nvdUScpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*
discourse discourse= 1.2.0nvdUScpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*
discourse discourse= 1.3.0nvdUScpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*
discourse discourse= 1.4.0nvdUScpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*
discourse discourse= 1.5.0nvdUScpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*
discourse discourse= 1.6.0nvdUScpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*
discourse discourse= 1.7.0nvdUScpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*
discourse discourse= 1.8.0nvdUScpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*
discourse discourse= 1.9.0nvdUScpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*
discourse discourse= 2.0.0nvdUScpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*
discourse discourse= 2.1.0nvdUScpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*
discourse discourse= 2.2.0nvdUScpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*
discourse discourse= 2.3.0nvdUScpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*
discourse discourse= 2.4.0nvdUScpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*
discourse discourse= 2.5.0nvdUScpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*

20 von 27 angezeigt

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

BIT-discourse-2023-23621Discourse vulnerable to ReDoS in user agent parsing2024-03-06vendor · osvUS
Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and version 3.1.0.beta2 on the `beta` and `tests-passed` branches, a malicious user can cause a regular expression denial of service using a carefully crafted user agent. This issue is patched in version 3.0.1 on the `stable` branch and version 3.1.0.beta2 on the `beta` and `tests-passed` branches. There are no known workarounds.

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu osv nvd NVD CVE.org MITRE

veröffentlicht 2023-01-28geändert 2026-06-17

verwandt (604)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2023-3364US	high7.5	44.5% (99th)	—	2023-08-02
An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2…
CVE-2022-24713US	high7.5	14.5% (97th)	Exploit	2022-03-08
regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted rege…
CVE-2024-8124US	high7.5	40.2% (99th)	—	2024-09-12
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.1.7, starting from 17.2 prior to 17.2.5, starting from 17.3 prior to 17.3.2 which cou…
CVE-2021-3749US	high7.5	8.52% (95th)	Exploit	2021-08-31
axios is vulnerable to Inefficient Regular Expression Complexity
CVE-2024-25126US	high7.5	35.4% (98th)	—	2024-02-29
Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leading to a possible deni…

+599 weitere

Referenzen (11)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan