PT-2024-27456 · Discourse · Discourse

Nattsw · Published 2024-07-30 · Updated 2024-09-11 · CVE-2024-37299

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.2.5 Discourse versions prior to 3.3.0.beta5

Description The issue concerns crafting requests to submit very long tag group names, which can reduce the availability of a Discourse instance.

Recommendations For versions prior to 3.2.5, update to version 3.2.5 to resolve the issue. For versions prior to 3.3.0.beta5, update to version 3.3.0.beta5 to resolve the issue.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BIT-DISCOURSE-2024-37299

CVE-2024-37299

GHSA-4J6H-9PJP-5476

Affected Products

Discourse

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37299.json · Exploit
• https://github.com/discourse/discourse/commit/76f06f6b1491db6bd09a4017d2c5591431b3b16e · Patch
• https://github.com/discourse/discourse/commit/188cb58daa833839c54c266ce22db150a3f3a210 · Patch
• https://github.com/discourse/discourse/security/advisories/GHSA-4j6h-9pjp-5476 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-37299 · Security Note
• https://osv.dev/vulnerability/BIT-discourse-2024-37299 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-37299 · Vendor Advisory
• https://t.me/cvedetector/2041 · Telegram Post
• https://t.me/cvenotify/87923 · Telegram Post
• https://t.me/cvenotify/94166 · Telegram Post
• https://t.me/cvenotify/88043 · Telegram Post