PT-2024-19002 · Discourse · Discourse

Lillinator · Published 2024-01-12 · Updated 2024-03-06 · CVE-2024-21655

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.1.4 Discourse versions prior to 3.2.0.beta4

Description Discourse is a platform for community discussion. For fields that are client editable, limits on sizes are not imposed. This allows a malicious actor to cause a Discourse instance to use excessive disk space and also often excessive bandwidth.

Recommendations For versions prior to 3.1.4, update to version 3.1.4 or later to resolve the issue. For versions prior to 3.2.0.beta4, update to version 3.2.0.beta4 or later to resolve the issue. As a temporary workaround, consider restricting the size of client-editable fields to prevent excessive disk space and bandwidth usage.

Exploit

Fix

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

BIT-DISCOURSE-2024-21655

CVE-2024-21655

GHSA-M5FC-94MM-38FX

Affected Products

Discourse

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21655.json · Exploit
• https://github.com/discourse/discourse/security/advisories/GHSA-m5fc-94mm-38fx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-21655 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21655 · Security Note
• https://osv.dev/vulnerability/BIT-discourse-2024-21655 · Vendor Advisory
• https://t.me/cvenotify/68670 · Telegram Post
• https://twitter.com/CVEnew/status/1745917001988518134 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1745957583951651131 · Twitter Post