PT-2023-29863 · Discourse · Discourse

0-0Eth0 + 1 · Publicado 2023-11-10 · Atualizado 2024-03-06 · CVE-2023-46130

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.1.3 Discourse versions prior to 3.2.0.beta3

Description Discourse is an open source platform for community discussion. The issue affects the availability of subsequent replies in a topic when users can add svgs with unlimited height attributes. This is possible in some theme components, specifically the svgbob or the mermaid theme component. Most Discourse instances are unaffected.

Recommendations For versions prior to 3.1.3, update to version 3.1.3 or later. For versions prior to 3.2.0.beta3, update to version 3.2.0.beta3 or later. As a temporary workaround, consider disabling or removing the relevant theme components, specifically the svgbob or the mermaid theme component.

Exploit

Correção

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-770

Identificadores relacionados

BIT-DISCOURSE-2023-46130

CVE-2023-46130

GHSA-C876-638R-VFCG

Produtos afetados

Discourse

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46130.json · Exploit
• https://github.com/discourse/discourse/commit/89a2e60706ce22e4afc463d03af2f34c53291800 · Correção
• https://github.com/discourse/discourse/security/advisories/GHSA-c876-638r-vfcg · Aviso do Fabricante
• https://github.com/discourse/discourse/commit/6183d9633de873ac2b1e9cdb6ac1c94b4ffae9cb · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2023-46130 · Nota de Segurança
• https://twitter.com/CVEnew/status/1722996456351506699 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1723039770282963120 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-46130 · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-discourse-2023-46130 · Aviso do Fabricante