CVE-2023-22740

Discourse is an open source platform for community discussion. Versions prior to 3.1.0.beta1 (beta) (tests-passed) are vulnerable to Allocation of Resources Without Limits. Users can create chat drafts of an unlimited length, which can cause a denial of service by generating an excessive load on the server. Additionally, an unlimited number of drafts were loaded when loading the user. This issue has been patched in version 2.1.0.beta1 (beta) and (tests-passed). Users should upgrade to the latest version where a limit has been introduced. There are no workarounds available.
Configurations

Configuration 1 (hide)

cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*

History

21 Nov 2024, 07:45

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 6.5
v2 : unknown
v3 : 4.3
Summary
  • (es) Discourse es una plataforma de código abierto para el debate comunitario. Las versiones anteriores a la 3.1.0.beta1 (beta) (pruebas aprobadas) son vulnerables a Asignación de Recursos Sin Límites. Los usuarios pueden crear borradores de chat de duración ilimitada, lo que puede provocar una denegación de servicio al generar una carga excesiva en el servidor. Además, se cargaba una cantidad ilimitada de borradores al cargar el usuario. Este problema se solucionó en la versión 2.1.0.beta1 (beta) y (pruebas aprobadas). Los usuarios deben actualizar a la última versión donde se haya introducido un límite. No hay soluciones disponibles.
References () https://github.com/discourse/discourse/commit/5eaf0802398ff06604f03b27a28dd274f2ffa576 - Patch, Third Party Advisory () https://github.com/discourse/discourse/commit/5eaf0802398ff06604f03b27a28dd274f2ffa576 - Patch, Third Party Advisory
References () https://github.com/discourse/discourse/security/advisories/GHSA-pwj4-rf62-p224 - Third Party Advisory () https://github.com/discourse/discourse/security/advisories/GHSA-pwj4-rf62-p224 - Third Party Advisory

Information

Published : 2023-01-27 01:15

Updated : 2024-11-21 07:45


NVD link : CVE-2023-22740

Mitre link : CVE-2023-22740

CVE.ORG link : CVE-2023-22740


JSON object : View

Products Affected

discourse

  • discourse
CWE
CWE-770

Allocation of Resources Without Limits or Throttling