PT-2023-18681 · Discourse · Discourse

Pmusaraj · Published 2023-01-27 · Updated 2024-03-06 · CVE-2023-22740

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.1.0.beta1

Description Discourse is an open source platform for community discussion. The issue concerns the allocation of resources without limits, allowing users to create chat drafts of an unlimited length. This can cause a denial of service by generating an excessive load on the server. Additionally, an unlimited number of drafts were loaded when loading the user.

Recommendations For versions prior to 3.1.0.beta1, upgrade to the latest version where a limit has been introduced to prevent the allocation of resources without limits. At the moment, there is no information about other workarounds for this issue.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BIT-DISCOURSE-2023-22740

CVE-2023-22740

GHSA-PWJ4-RF62-P224

Affected Products

Discourse

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22740.json · Exploit
• https://github.com/discourse/discourse/commit/5eaf0802398ff06604f03b27a28dd274f2ffa576 · Patch
• https://osv.dev/vulnerability/BIT-discourse-2023-22740 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22740 · Security Note
• https://osv.dev/vulnerability/CVE-2023-22740 · Vendor Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-pwj4-rf62-p224 · Note
• https://t.me/cibsecurity/57020 · Telegram Post
• https://t.me/cvenotify/42927 · Telegram Post