PT-2023-12730 · Discourse · Discourse

Imlonghao + 1 · Publicado 2023-01-05 · Atualizado 2024-03-06 · CVE-2022-23548

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2.8.14 on the stable branch Discourse versions prior to 2.9.0.beta16 on the beta and tests-passed branches

Description The issue affects the parsing of posts in Discourse, making it susceptible to regular expression denial of service (ReDoS) attacks. This allows for potential disruption of service. There are no known workarounds for this issue.

Recommendations For Discourse versions prior to 2.8.14 on the stable branch, update to version 2.8.14 to resolve the issue. For Discourse versions prior to 2.9.0.beta16 on the beta and tests-passed branches, update to version 2.9.0.beta16 to resolve the issue.

Exploit

Correção

DoS

Enumeração de Fraquezas

CWE-1333

Identificadores relacionados

BIT-DISCOURSE-2022-23548

CVE-2022-23548

GHSA-7RW2-F4X7-7PXF

Produtos afetados

Discourse

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23548.json · Exploit
• https://github.com/discourse/discourse/security/advisories/GHSA-7rw2-f4x7-7pxf · Nota
• https://github.com/discourse/discourse/pull/19737 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2022-23548 · Nota de Segurança
• https://osv.dev/vulnerability/BIT-discourse-2022-23548 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2022-23548 · Aviso do Fabricante
• https://t.me/cvenotify/42191 · Publicação no Telegram
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23548 · Nota
• https://t.me/cibsecurity/56009 · Publicação no Telegram