PT-2023-29698 · Discourse · Discourse

Pikariop · Published 2023-11-10 · Updated 2024-03-06 · CVE-2023-45806

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.1.3 Discourse version 3.2.0.beta3 and earlier in the beta and tests-passed branches

Description Discourse is an open source platform for community discussion. If a user has been quoted and uses a | in their full name, they might be able to trigger a bug that generates a lot of duplicate content in all the posts they've been quoted by updating their full name again. No known workaround exists, although one can stop the "bleeding" by ensuring users only use alphanumeric characters in their full name field.

Recommendations For versions prior to 3.1.3, update to version 3.1.3 or later. For version 3.2.0.beta3 and earlier in the beta and tests-passed branches, update to version 3.2.0.beta3 or later. As a temporary workaround, consider ensuring users only use alphanumeric characters in their full name field until a patch is applied.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

BIT-DISCOURSE-2023-45806

CVE-2023-45806

GHSA-HCGF-HG2G-MW78

Affected Products

Discourse

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45806.json · Exploit
• https://github.com/discourse/discourse/commit/7d484864fe91ff79c478f57e7ddb1235d701921e · Patch
• https://github.com/discourse/discourse/security/advisories/GHSA-hcgf-hg2g-mw78 · Vendor Advisory
• https://github.com/discourse/discourse/commit/2ec25105179199cf80912bf011c18b8b870e1863 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-45806 · Security Note
• https://osv.dev/vulnerability/BIT-discourse-2023-45806 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-45806 · Vendor Advisory
• https://t.me/cvenotify/60615 · Telegram Post
• https://twitter.com/CVEnew/status/1722990650684031061 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1723040530236313834 · Twitter Post