PT-2023-26570

CVE-2023-38706

Published

2023-09-15

Updated

2024-03-06

Description by

CVSS 3.1

6.5

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.1.1 Discourse version 3.2.0.beta1 and earlier in the beta and tests-passed branches

Description A malicious user can create an unlimited number of drafts with very long draft keys, potentially exhausting server resources.

Recommendations For versions prior to 3.1.1, update to version 3.1.1 or later. For version 3.2.0.beta1 and earlier in the beta and tests-passed branches, update to version 3.2.0.beta1 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Jomaxro

Vendors

Affected products

Weakness enumeration

CWE-770: Allocation of Resources Without Limits or Throttling

Related identifiers

CVE-2023-38706