PT-2023-12730 · Discourse · Discourse

Imlonghao + 1 · Published 2023-01-05 · Updated 2024-03-06 · CVE-2022-23548

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2.8.14 on the stable branch Discourse versions prior to 2.9.0.beta16 on the beta and tests-passed branches

Description The issue affects the parsing of posts in Discourse, making it susceptible to regular expression denial of service (ReDoS) attacks. This allows for potential disruption of service. There are no known workarounds for this issue.

Recommendations For Discourse versions prior to 2.8.14 on the stable branch, update to version 2.8.14 to resolve the issue. For Discourse versions prior to 2.9.0.beta16 on the beta and tests-passed branches, update to version 2.9.0.beta16 to resolve the issue.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

BIT-DISCOURSE-2022-23548

CVE-2022-23548

GHSA-7RW2-F4X7-7PXF

Affected Products

Discourse

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23548.json · Exploit
• https://github.com/discourse/discourse/pull/19737 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-23548 · Security Note
• https://osv.dev/vulnerability/BIT-discourse-2022-23548 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23548 · Vendor Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-7rw2-f4x7-7pxf · Note
• https://t.me/cvenotify/42191 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23548 · Note
• https://t.me/cibsecurity/56009 · Telegram Post