PT-2023-19078 · Discourse · Discourse

Lownattsw · Published 2023-01-27 · Updated 2024-03-06 · CVE-2023-23616

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.0.1 on the stable branch Discourse versions prior to 3.1.0.beta2 on the beta and tests-passed branches

Description The issue concerns the submission of membership requests, where there is no character limit for the reason provided. This could potentially allow a user to flood the database with a large amount of data. However, it is unlikely to be used as part of a Denial of Service (DoS) attack, as the paths reading back the reasons are only available to administrators. A character limit of 280 characters has been introduced for membership requests in later versions.

Recommendations For Discourse versions prior to 3.0.1 on the stable branch, update to version 3.0.1 or later to introduce a character limit for membership requests. For Discourse versions prior to 3.1.0.beta2 on the beta and tests-passed branches, update to version 3.1.0.beta2 or later to introduce a character limit for membership requests.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BIT-DISCOURSE-2023-23616

CVE-2023-23616

GHSA-6XFF-P329-9PGF

Affected Products

Discourse

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/23xxx/CVE-2023-23616.json · Exploit
• https://github.com/discourse/discourse/commit/3e0cc4a5d9ef44ad902f6985d046ebb32f0a14ee · Patch
• https://github.com/discourse/discourse/commit/d5745d34c20c31a221039d8913f33064433003ea · Patch
• https://github.com/discourse/discourse/pull/19993 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-23616 · Security Note
• https://osv.dev/vulnerability/BIT-discourse-2023-23616 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-23616 · Vendor Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-6xff-p329-9pgf · Note
• https://t.me/cibsecurity/57120 · Telegram Post