PT-2023-12730

CVE-2022-23548

Published

2023-01-05

Updated

2024-03-06

Description by

CVSS 3.1

6.5

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2.8.14 on the stable branch Discourse versions prior to 2.9.0.beta16 on the beta and tests-passed branches

Description The issue affects the parsing of posts in Discourse, making it susceptible to regular expression denial of service (ReDoS) attacks. This allows for potential disruption of service. There are no known workarounds for this issue.

Recommendations For Discourse versions prior to 2.8.14 on the stable branch, update to version 2.8.14 to resolve the issue. For Discourse versions prior to 2.9.0.beta16 on the beta and tests-passed branches, update to version 2.9.0.beta16 to resolve the issue.

Exploitability

Exploit

Fix

Impacts

Researchers

Imlonghao

Jomaxro

Vendors

Affected products

Weakness enumeration

CWE-1333: Inefficient Regular Expression Complexity

Related identifiers