6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
0.001 Low
EPSS
Percentile
27.1%
Discourse is an option source discussion platform. Prior to version 2.8.14 on the stable
branch and version 2.9.0.beta16 on the beta
and tests-passed
branches, users can create posts with raw body longer than the max_length
site setting by including html comments that are not counted toward the character limit. This issue is patched in versions 2.8.14 and 2.9.0.beta16. There are no known workarounds.
[
{
"vendor": "discourse",
"product": "discourse",
"versions": [
{
"version": "2.8.14",
"status": "affected",
"lessThan": "2.8.14",
"versionType": "custom"
},
{
"version": "2.9.0.beta0",
"status": "affected",
"lessThanOrEqual": "2.9.0.beta0",
"versionType": "custom"
},
{
"version": "2.9.0.beta16",
"status": "affected",
"lessThan": "2.9.0.beta16",
"versionType": "custom"
}
]
}
]