PT-2023-12731 · Discourse · Discourse

Jomaxro · CVE-2022-23549 · Publicado 2023-01-05 · Atualizado 2024-03-06

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2.8.14 on the stable branch and prior to 2.9.0.beta16 on the beta and tests-passed branches

Description The issue allows users to create posts with a raw body longer than the max length site setting by including HTML comments that are not counted toward the character limit. This is possible due to the way HTML comments are handled in posts. There are no known workarounds for this issue.

Recommendations For versions prior to 2.8.14 on the stable branch, update to version 2.8.14 or later. For versions prior to 2.9.0.beta16 on the beta and tests-passed branches, update to version 2.9.0.beta16 or later.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BIT-DISCOURSE-2022-23549

CVE-2022-23549

GHSA-P47G-V5WR-P4XP

Produtos afetados

Discourse

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23549.json · Exploit
• https://github.com/discourse/discourse/security/advisories/GHSA-p47g-v5wr-p4xp · Nota
• https://github.com/discourse/discourse/commit/bf6b08670a927cc80bb090b7a2e710b4b554e6a8 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2022-23549 · Nota de Segurança
• https://t.me/cvenotify/41874 · Publicação no Telegram
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23549 · Nota
• https://osv.dev/vulnerability/CVE-2022-23549 · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-discourse-2022-23549 · Aviso do Fabricante
• https://t.me/cibsecurity/56003 · Publicação no Telegram