PT-2023-30324 · Discourse+1 · Discourse+1

Highjomaxro · Published 2023-11-10 · Updated 2024-03-06 · CVE-2023-47120

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Discourse versions 3.1.0 through 3.1.2 Discourse versions 3.1.0,beta6 through 3.2.0.beta2

Description Discourse is an open source platform for community discussion. In the affected versions, Redis memory can be depleted by crafting a site with an abnormally long favicon URL and drafting multiple posts which Onebox it.

Recommendations For Discourse versions 3.1.0 through 3.1.2, update to version 3.1.3 or later. For Discourse versions 3.1.0,beta6 through 3.2.0.beta2, update to version 3.2.0.beta3 or later.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BIT-DISCOURSE-2023-47120

CVE-2023-47120

GHSA-77CW-XHJ8-HFP3

Affected Products

Discourse

Redis

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/47xxx/CVE-2023-47120.json · Exploit
• https://github.com/discourse/discourse/security/advisories/GHSA-77cw-xhj8-hfp3 · Vendor Advisory
• https://github.com/discourse/discourse/commit/95a82d608d6377faf68a0e2c5d9640b043557852 · Patch
• https://github.com/discourse/discourse/commit/e910dd09140cb4abc3a563b95af4a137ca7fa0ce · Patch
• https://osv.dev/vulnerability/BIT-discourse-2023-47120 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-47120 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-47120 · Security Note
• https://t.me/latest_high_impact_cve/84 · Telegram Post
• https://t.me/cvenotify/60632 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1723038250736963825 · Twitter Post
• https://twitter.com/CVEnew/status/1722999467216130266 · Twitter Post