Lucene search

K
nvd[email protected]NVD:CVE-2023-41042
HistorySep 15, 2023 - 8:15 p.m.

CVE-2023-41042

2023-09-1520:15:10
CWE-770
web.nvd.nist.gov
cve-2023-41042
open-source discussion platform
remote theme import
memory limits

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

5.4 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

Discourse is an open-source discussion platform. Prior to version 3.1.1 of the stable branch and version 3.2.0.beta1 of the beta and tests-passed branches, importing a remote theme loads their assets into memory without enforcing limits for file size or number of files. The issue is patched in version 3.1.1 of the stable branch and version 3.2.0.beta1 of the beta and tests-passed branches. There are no known workarounds.

Affected configurations

NVD
Node
discoursediscourseRange<3.1.1stable
Node
discoursediscourseMatch1.1.0beta1beta
OR
discoursediscourseMatch1.1.0beta2beta
OR
discoursediscourseMatch1.1.0beta3beta
OR
discoursediscourseMatch1.1.0beta4beta
OR
discoursediscourseMatch1.1.0beta5beta
OR
discoursediscourseMatch1.1.0beta6beta
OR
discoursediscourseMatch1.1.0beta6bbeta
OR
discoursediscourseMatch1.1.0beta7beta
OR
discoursediscourseMatch1.1.0beta8beta
OR
discoursediscourseMatch1.2.0beta1beta
OR
discoursediscourseMatch1.2.0beta2beta
OR
discoursediscourseMatch1.2.0beta3beta
OR
discoursediscourseMatch1.2.0beta4beta
OR
discoursediscourseMatch1.2.0beta5beta
OR
discoursediscourseMatch1.2.0beta6beta
OR
discoursediscourseMatch1.2.0beta7beta
OR
discoursediscourseMatch1.2.0beta8beta
OR
discoursediscourseMatch1.2.0beta9beta
OR
discoursediscourseMatch1.3.0beta1beta
OR
discoursediscourseMatch1.3.0beta10beta
OR
discoursediscourseMatch1.3.0beta11beta
OR
discoursediscourseMatch1.3.0beta2beta
OR
discoursediscourseMatch1.3.0beta3beta
OR
discoursediscourseMatch1.3.0beta4beta
OR
discoursediscourseMatch1.3.0beta5beta
OR
discoursediscourseMatch1.3.0beta6beta
OR
discoursediscourseMatch1.3.0beta7beta
OR
discoursediscourseMatch1.3.0beta8beta
OR
discoursediscourseMatch1.3.0beta9beta
OR
discoursediscourseMatch1.4.0beta1beta
OR
discoursediscourseMatch1.4.0beta10beta
OR
discoursediscourseMatch1.4.0beta11beta
OR
discoursediscourseMatch1.4.0beta12beta
OR
discoursediscourseMatch1.4.0beta2beta
OR
discoursediscourseMatch1.4.0beta3beta
OR
discoursediscourseMatch1.4.0beta4beta
OR
discoursediscourseMatch1.4.0beta5beta
OR
discoursediscourseMatch1.4.0beta6beta
OR
discoursediscourseMatch1.4.0beta7beta
OR
discoursediscourseMatch1.4.0beta8beta
OR
discoursediscourseMatch1.4.0beta9beta
OR
discoursediscourseMatch1.5.0beta1beta
OR
discoursediscourseMatch1.5.0beta10beta
OR
discoursediscourseMatch1.5.0beta11beta
OR
discoursediscourseMatch1.5.0beta12beta
OR
discoursediscourseMatch1.5.0beta13beta
OR
discoursediscourseMatch1.5.0beta13bbeta
OR
discoursediscourseMatch1.5.0beta14beta
OR
discoursediscourseMatch1.5.0beta2beta
OR
discoursediscourseMatch1.5.0beta3beta
OR
discoursediscourseMatch1.5.0beta4beta
OR
discoursediscourseMatch1.5.0beta5beta
OR
discoursediscourseMatch1.5.0beta6beta
OR
discoursediscourseMatch1.5.0beta7beta
OR
discoursediscourseMatch1.5.0beta8beta
OR
discoursediscourseMatch1.5.0beta9beta
OR
discoursediscourseMatch1.6.0beta1beta
OR
discoursediscourseMatch1.6.0beta10beta
OR
discoursediscourseMatch1.6.0beta11beta
OR
discoursediscourseMatch1.6.0beta12beta
OR
discoursediscourseMatch1.6.0beta2beta
OR
discoursediscourseMatch1.6.0beta3beta
OR
discoursediscourseMatch1.6.0beta4beta
OR
discoursediscourseMatch1.6.0beta5beta
OR
discoursediscourseMatch1.6.0beta6beta
OR
discoursediscourseMatch1.6.0beta7beta
OR
discoursediscourseMatch1.6.0beta8beta
OR
discoursediscourseMatch1.6.0beta9beta
OR
discoursediscourseMatch1.7.0beta1beta
OR
discoursediscourseMatch1.7.0beta10beta
OR
discoursediscourseMatch1.7.0beta11beta
OR
discoursediscourseMatch1.7.0beta2beta
OR
discoursediscourseMatch1.7.0beta3beta
OR
discoursediscourseMatch1.7.0beta4beta
OR
discoursediscourseMatch1.7.0beta5beta
OR
discoursediscourseMatch1.7.0beta6beta
OR
discoursediscourseMatch1.7.0beta7beta
OR
discoursediscourseMatch1.7.0beta8beta
OR
discoursediscourseMatch1.7.0beta9beta
OR
discoursediscourseMatch1.8.0beta1beta
OR
discoursediscourseMatch1.8.0beta10beta
OR
discoursediscourseMatch1.8.0beta11beta
OR
discoursediscourseMatch1.8.0beta12beta
OR
discoursediscourseMatch1.8.0beta13beta
OR
discoursediscourseMatch1.8.0beta2beta
OR
discoursediscourseMatch1.8.0beta3beta
OR
discoursediscourseMatch1.8.0beta4beta
OR
discoursediscourseMatch1.8.0beta5beta
OR
discoursediscourseMatch1.8.0beta6beta
OR
discoursediscourseMatch1.8.0beta7beta
OR
discoursediscourseMatch1.8.0beta8beta
OR
discoursediscourseMatch1.8.0beta9beta
OR
discoursediscourseMatch1.9.0beta1beta
OR
discoursediscourseMatch1.9.0beta10beta
OR
discoursediscourseMatch1.9.0beta11beta
OR
discoursediscourseMatch1.9.0beta12beta
OR
discoursediscourseMatch1.9.0beta13beta
OR
discoursediscourseMatch1.9.0beta14beta
OR
discoursediscourseMatch1.9.0beta15beta
OR
discoursediscourseMatch1.9.0beta16beta
OR
discoursediscourseMatch1.9.0beta17beta
OR
discoursediscourseMatch1.9.0beta2beta
OR
discoursediscourseMatch1.9.0beta3beta
OR
discoursediscourseMatch1.9.0beta4beta
OR
discoursediscourseMatch1.9.0beta5beta
OR
discoursediscourseMatch1.9.0beta6beta
OR
discoursediscourseMatch1.9.0beta7beta
OR
discoursediscourseMatch1.9.0beta8beta
OR
discoursediscourseMatch1.9.0beta9beta
OR
discoursediscourseMatch2.0.0beta1beta
OR
discoursediscourseMatch2.0.0beta10beta
OR
discoursediscourseMatch2.0.0beta2beta
OR
discoursediscourseMatch2.0.0beta3beta
OR
discoursediscourseMatch2.0.0beta4beta
OR
discoursediscourseMatch2.0.0beta5beta
OR
discoursediscourseMatch2.0.0beta6beta
OR
discoursediscourseMatch2.0.0beta7beta
OR
discoursediscourseMatch2.0.0beta8beta
OR
discoursediscourseMatch2.0.0beta9beta
OR
discoursediscourseMatch2.1.0beta1beta
OR
discoursediscourseMatch2.1.0beta2beta
OR
discoursediscourseMatch2.1.0beta3beta
OR
discoursediscourseMatch2.1.0beta4beta
OR
discoursediscourseMatch2.1.0beta5beta
OR
discoursediscourseMatch2.1.0beta6beta
OR
discoursediscourseMatch2.2.0beta1beta
OR
discoursediscourseMatch2.2.0beta10beta
OR
discoursediscourseMatch2.2.0beta2beta
OR
discoursediscourseMatch2.2.0beta3beta
OR
discoursediscourseMatch2.2.0beta4beta
OR
discoursediscourseMatch2.2.0beta5beta
OR
discoursediscourseMatch2.2.0beta6beta
OR
discoursediscourseMatch2.2.0beta7beta
OR
discoursediscourseMatch2.2.0beta8beta
OR
discoursediscourseMatch2.2.0beta9beta
OR
discoursediscourseMatch2.3.0beta1beta
OR
discoursediscourseMatch2.3.0beta10beta
OR
discoursediscourseMatch2.3.0beta11beta
OR
discoursediscourseMatch2.3.0beta2beta
OR
discoursediscourseMatch2.3.0beta3beta
OR
discoursediscourseMatch2.3.0beta4beta
OR
discoursediscourseMatch2.3.0beta5beta
OR
discoursediscourseMatch2.3.0beta6beta
OR
discoursediscourseMatch2.3.0beta7beta
OR
discoursediscourseMatch2.3.0beta8beta
OR
discoursediscourseMatch2.3.0beta9beta
OR
discoursediscourseMatch2.4.0beta1beta
OR
discoursediscourseMatch2.4.0beta10beta
OR
discoursediscourseMatch2.4.0beta11beta
OR
discoursediscourseMatch2.4.0beta2beta
OR
discoursediscourseMatch2.4.0beta3beta
OR
discoursediscourseMatch2.4.0beta4beta
OR
discoursediscourseMatch2.4.0beta5beta
OR
discoursediscourseMatch2.4.0beta6beta
OR
discoursediscourseMatch2.4.0beta7beta
OR
discoursediscourseMatch2.4.0beta8beta
OR
discoursediscourseMatch2.4.0beta9beta
OR
discoursediscourseMatch2.5.0beta1beta
OR
discoursediscourseMatch2.5.0beta2beta
OR
discoursediscourseMatch2.5.0beta3beta
OR
discoursediscourseMatch2.5.0beta4beta
OR
discoursediscourseMatch2.5.0beta5beta
OR
discoursediscourseMatch2.5.0beta6beta
OR
discoursediscourseMatch2.5.0beta7beta
OR
discoursediscourseMatch2.6.0beta1beta
OR
discoursediscourseMatch2.6.0beta2beta
OR
discoursediscourseMatch2.6.0beta3beta
OR
discoursediscourseMatch2.6.0beta4beta
OR
discoursediscourseMatch2.6.0beta5beta
OR
discoursediscourseMatch2.6.0beta6beta
OR
discoursediscourseMatch2.7.0beta1beta
OR
discoursediscourseMatch2.7.0beta2beta
OR
discoursediscourseMatch2.7.0beta3beta
OR
discoursediscourseMatch2.7.0beta4beta
OR
discoursediscourseMatch2.7.0beta5beta
OR
discoursediscourseMatch2.7.0beta6beta
OR
discoursediscourseMatch2.7.0beta7beta
OR
discoursediscourseMatch2.7.0beta8beta
OR
discoursediscourseMatch2.7.0beta9beta
OR
discoursediscourseMatch2.8.0beta1beta
OR
discoursediscourseMatch2.8.0beta10beta
OR
discoursediscourseMatch2.8.0beta11beta
OR
discoursediscourseMatch2.8.0beta2beta
OR
discoursediscourseMatch2.8.0beta3beta
OR
discoursediscourseMatch2.8.0beta4beta
OR
discoursediscourseMatch2.8.0beta5beta
OR
discoursediscourseMatch2.8.0beta6beta
OR
discoursediscourseMatch2.8.0beta7beta
OR
discoursediscourseMatch2.8.0beta8beta
OR
discoursediscourseMatch2.8.0beta9beta
OR
discoursediscourseMatch2.9.0beta1beta
OR
discoursediscourseMatch2.9.0beta10beta
OR
discoursediscourseMatch2.9.0beta11beta
OR
discoursediscourseMatch2.9.0beta12beta
OR
discoursediscourseMatch2.9.0beta13beta
OR
discoursediscourseMatch2.9.0beta14beta
OR
discoursediscourseMatch2.9.0beta2beta
OR
discoursediscourseMatch2.9.0beta3beta
OR
discoursediscourseMatch2.9.0beta4beta
OR
discoursediscourseMatch2.9.0beta5beta
OR
discoursediscourseMatch2.9.0beta6beta
OR
discoursediscourseMatch2.9.0beta7beta
OR
discoursediscourseMatch2.9.0beta8beta
OR
discoursediscourseMatch2.9.0beta9beta
OR
discoursediscourseMatch3.0.0beta15beta
OR
discoursediscourseMatch3.0.0beta16beta
OR
discoursediscourseMatch3.1.0beta1beta
OR
discoursediscourseMatch3.1.0beta2beta
OR
discoursediscourseMatch3.1.0beta3beta
OR
discoursediscourseMatch3.1.0beta5beta
OR
discoursediscourseMatch3.1.0beta6beta
OR
discoursediscourseMatch3.1.0beta7beta
OR
discoursediscourseMatch3.1.0beta8beta

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

5.4 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

Related for NVD:CVE-2023-41042