PT-2023-27756 · Discourse · Discourse

Jomaxro · Publicado 2023-09-15 · Atualizado 2024-03-06 · CVE-2023-41043

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.1.1 of the stable branch Discourse versions prior to 3.2.0.beta1 of the beta and tests-passed branches

Description A malicious admin could create extremely large icons sprites, which would then be cached in each server process, potentially causing server processes to be killed and leading to downtime. This issue is a concern for multisite installations, but no action is required when admins are trusted.

Recommendations For versions prior to 3.1.1 of the stable branch, update to version 3.1.1 or later. For versions prior to 3.2.0.beta1 of the beta and tests-passed branches, update to version 3.2.0.beta1 or later. As a temporary workaround, consider restricting the ability of admins to create large icons sprites until a patch is applied.

Exploit

Correção

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-770

Identificadores relacionados

BIT-DISCOURSE-2023-41043

CVE-2023-41043

GHSA-28HH-H5XW-XGVX

Produtos afetados

Discourse

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41043.json · Exploit
• https://github.com/discourse/discourse/security/advisories/GHSA-28hh-h5xw-xgvx · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-41043 · Nota de Segurança
• https://t.me/cibsecurity/70612 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-41043 · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-discourse-2023-41043 · Aviso do Fabricante