PT-2023-27755

CVE-2023-41042

Publicado

2023-09-15

Atualizado

2024-03-06

Descrição por

CVSS 3.1

4.9

Média

MétricasAV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.1.1 Discourse version 3.2.0.beta1 and earlier in the beta and tests-passed branches

Description Discourse is an open-source discussion platform. Importing a remote theme loads their assets into memory without enforcing limits for file size or number of files.

Recommendations For versions prior to 3.1.1, update to version 3.1.1 or later. For version 3.2.0.beta1 and earlier in the beta and tests-passed branches, update to version 3.2.0.beta1 or later.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Jomaxro

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-770: Allocation of Resources Without Limits or Throttling

Identificadores relacionados

CVE-2023-41042