PT-2022-24824 · Discourse · Discourse

Jomaxro · Published 2022-09-29 · Updated 2024-03-06 · CVE-2022-39226

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2.8.9 Discourse versions prior to 2.9.0.beta10

Description A malicious actor can add large payloads of text into the Location and Website fields of a user profile, causing issues for other users when loading that profile.

Recommendations For versions prior to 2.8.9, update to version 2.8.9 or later on the stable branch. For versions prior to 2.9.0.beta10, update to version 2.9.0.beta10 or later on the beta and tests-passed branches.

Exploit

Fix

Allocation of Resources Without Limits

RCE

Weakness Enumeration

CWE-770

CWE-20

Related Identifiers

BIT-DISCOURSE-2022-39226

CVE-2022-39226

GHSA-JW3Q-XG5G-QJRW

Affected Products

Discourse

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39226.json · Exploit
• https://github.com/discourse/discourse/commit/e69f7d2fd9c977dedbdb17f6813651e2a45bfb71 · Patch
• https://github.com/discourse/discourse/pull/18302 · Patch
• https://osv.dev/vulnerability/BIT-discourse-2022-39226 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39226 · Security Note
• https://osv.dev/vulnerability/CVE-2022-39226 · Vendor Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-jw3q-xg5g-qjrw · Note
• https://t.me/cibsecurity/50748 · Telegram Post