PT-2023-26478 · Discourse · Discourse

Jomaxro · Publicado 2023-07-28 · Atualizado 2024-03-06 · CVE-2023-38498

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.0.6 of the stable branch and version 3.1.0.beta7 of the beta and tests-passed branches

Description A malicious user can prevent the defer queue from proceeding promptly on sites hosted in the same multisite installation. The issue affects Discourse, an open source discussion platform. Users of multisite configurations are at risk.

Recommendations For Discourse versions prior to 3.0.6 of the stable branch, upgrade to version 3.0.6. For Discourse versions prior to 3.1.0.beta7 of the beta and tests-passed branches, upgrade to version 3.1.0.beta7.

Exploit

Correção

Resource Exhaustion

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-400

CWE-770

Identificadores relacionados

BIT-DISCOURSE-2023-38498

CVE-2023-38498

GHSA-WV29-RM3F-4G2J

Produtos afetados

Discourse

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38498.json · Exploit
• https://github.com/discourse/discourse/security/advisories/GHSA-wv29-rm3f-4g2j · Aviso do Fabricante
• https://github.com/discourse/discourse/commit/26e267478d785e2f32ee7da4613e2cf4a65ff182 · Correção
• https://t.me/cibsecurity/67392 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-38498 · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-discourse-2023-38498 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-38498 · Nota de Segurança
• https://t.me/cvenotify/55454 · Publicação no Telegram