PT-2021-23140
CVE-2021-41163
·
تاريخ النشر
2021-10-20
·
تاريخ التحديث
2024-03-06
الوصف من
CVSS 3.1
10
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Discourse versions 2.7.8 and earlier
Description
Discourse is an open source platform for community discussion. In affected versions, maliciously crafted requests could lead to remote code execution. This resulted from a lack of validation in
subscribe url values. It is estimated that around 14,300 sites are potentially vulnerable, with 8,639 potentially vulnerable systems located in the USA.Recommendations
To resolve the issue, update to version 2.7.9 or later.
As a temporary workaround, consider blocking requests with a path starting with
/webhooks/aws at an upstream proxy. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾