PT-2023-30324 · Discourse+1 · Discourse+1

Highjomaxro · Publicado 2023-11-10 · Atualizado 2024-03-06 · CVE-2023-47120

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Discourse versions 3.1.0 through 3.1.2 Discourse versions 3.1.0,beta6 through 3.2.0.beta2

Description Discourse is an open source platform for community discussion. In the affected versions, Redis memory can be depleted by crafting a site with an abnormally long favicon URL and drafting multiple posts which Onebox it.

Recommendations For Discourse versions 3.1.0 through 3.1.2, update to version 3.1.3 or later. For Discourse versions 3.1.0,beta6 through 3.2.0.beta2, update to version 3.2.0.beta3 or later.

Exploit

Correção

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-770

Identificadores relacionados

BIT-DISCOURSE-2023-47120

CVE-2023-47120

GHSA-77CW-XHJ8-HFP3

Produtos afetados

Discourse

Redis

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/47xxx/CVE-2023-47120.json · Exploit
• https://github.com/discourse/discourse/security/advisories/GHSA-77cw-xhj8-hfp3 · Aviso do Fabricante
• https://github.com/discourse/discourse/commit/95a82d608d6377faf68a0e2c5d9640b043557852 · Correção
• https://github.com/discourse/discourse/commit/e910dd09140cb4abc3a563b95af4a137ca7fa0ce · Correção
• https://osv.dev/vulnerability/BIT-discourse-2023-47120 · Aviso do Fabricante
• https://t.me/latest_high_impact_cve/84 · Publicação no Telegram
• https://t.me/cvenotify/60632 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1723038250736963825 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-47120 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-47120 · Nota de Segurança
• https://twitter.com/CVEnew/status/1722999467216130266 · Publicação no Twitter