PT-2023-29863 · Discourse · Discourse

0-0Eth0 + 1 · Published 2023-11-10 · Updated 2024-03-06 · CVE-2023-46130

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.1.3 Discourse versions prior to 3.2.0.beta3

Description Discourse is an open source platform for community discussion. The issue affects the availability of subsequent replies in a topic when users can add svgs with unlimited height attributes. This is possible in some theme components, specifically the svgbob or the mermaid theme component. Most Discourse instances are unaffected.

Recommendations For versions prior to 3.1.3, update to version 3.1.3 or later. For versions prior to 3.2.0.beta3, update to version 3.2.0.beta3 or later. As a temporary workaround, consider disabling or removing the relevant theme components, specifically the svgbob or the mermaid theme component.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BIT-DISCOURSE-2023-46130

CVE-2023-46130

GHSA-C876-638R-VFCG

Affected Products

Discourse

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46130.json · Exploit
• https://github.com/discourse/discourse/commit/89a2e60706ce22e4afc463d03af2f34c53291800 · Patch
• https://github.com/discourse/discourse/security/advisories/GHSA-c876-638r-vfcg · Vendor Advisory
• https://github.com/discourse/discourse/commit/6183d9633de873ac2b1e9cdb6ac1c94b4ffae9cb · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-46130 · Security Note
• https://osv.dev/vulnerability/CVE-2023-46130 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-discourse-2023-46130 · Vendor Advisory
• https://twitter.com/CVEnew/status/1722996456351506699 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1723039770282963120 · Twitter Post