Lucene search

GitHub_MCVELIST:CVE-2023-25167

HistoryFeb 08, 2023 - 7:31 p.m.

CVE-2023-25167 Regular expression denial of service via installing themes via git in discourse

2023-02-0819:31:59

CWE-1333

GitHub_M

www.cve.org

discourse

open source

regular expression

denial of service

git url

upgrade

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

6.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

31.8%

JSON

Discourse is an open source discussion platform. In affected versions a malicious user can cause a regular expression denial of service using a carefully crafted git URL. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. Users are advised to upgrade. There are no known workarounds for this issue.

CNA Affected

[
  {
    "vendor": "discourse",
    "product": "discourse",
    "versions": [
      {
        "version": "< 3.0.1",
        "status": "affected"
      },
      {
        "version": ">= 3.1.0.beta, < 3.1.0.beta2",
        "status": "affected"
      }
    ]
  }
]

References

github.com/discourse/discourse/commit/ec4c30270887366dc28788bc4ab8a22a098573cd

github.com/discourse/discourse/security/advisories/GHSA-4w55-w26q-r35w

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

6.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

31.8%

JSON

Related for CVELIST:CVE-2023-25167