PT-2023-12730

CVE-2022-23548

Publicado

2023-01-05

Atualizado

2024-03-06

Descrição por

CVSS 3.1

6.5

Média

MétricasAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2.8.14 on the stable branch Discourse versions prior to 2.9.0.beta16 on the beta and tests-passed branches

Description The issue affects the parsing of posts in Discourse, making it susceptible to regular expression denial of service (ReDoS) attacks. This allows for potential disruption of service. There are no known workarounds for this issue.

Recommendations For Discourse versions prior to 2.8.14 on the stable branch, update to version 2.8.14 to resolve the issue. For Discourse versions prior to 2.9.0.beta16 on the beta and tests-passed branches, update to version 2.9.0.beta16 to resolve the issue.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Imlonghao

Jomaxro

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-1333: Inefficient Regular Expression Complexity

Identificadores relacionados