PT-2024-20113 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.1.5 Discourse versions prior to 3.2.0.beta5 Description: Discourse is an open-source discussion platform. Improperly sanitized user input could lead to an XSS issue in some situations. This issue only affects...

CVE-2024-23834: Improper Neutralization of Input During Web Page Generation

Discourse is an open-source discussion platform. Improperly sanitized user input could lead to an XSS vulnerability in some situations. This vulnerability only affects Discourse instances which have disabled the default Content Security Policy. The vulnerability is patched in 3.1.5 and 3.2.0.beta...

Discourse cross-site scripting vulnerabilities

Discourse is an open source community discussion platform. The platform includes features such as community, email and chat rooms. Discourse suffers from a cross-site scripting vulnerability that originates from improperly cleaned user input, which can be exploited by an attacker to execute...

Discourse Denial of Service Vulnerability

Discourse is an open source community discussion platform. The platform includes features such as community, email and chat rooms. Discourse suffers from a denial of service vulnerability that stems from the ability to create very long user arrays in the message serializer, which can be exploited...

Discourse Resource Management Error Vulnerability

Discourse is an open source community discussion platform. The platform includes features such as community, email and chat rooms. A resource management error vulnerability exists in Discourse, which stems from an unimposed size limit on client-side editable fields, and can be exploited by an...

Unspecified vulnerability in Discourse (CNVD-2024-14089)

Discourse is an open source community discussion platform. The platform includes features such as community, email and chat rooms. Discourse suffers from a security vulnerability that can be exploited by an attacker to access a secure upload URL associated with a post...

CVE-2024-21655

Discourse is a platform for community discussion. For fields that are client editable, limits on sizes are not imposed. This allows a malicious actor to cause a Discourse instance to use excessive disk space and also often excessive bandwidth. The issue is patched 3.1.4 and 3.2.0.beta4...

CVE-2023-48297

Discourse is a platform for community discussion. The message serializer uses the full list of expanded chat mentions @all and @here which can lead to a very long array of users. This issue was patched in versions 3.1.4 and beta 3.2.0.beta5...

CVE-2023-49099

Discourse is a platform for community discussion. Under very specific circumstances, secure upload URLs associated with posts can be accessed by guest users even when login is required. This vulnerability has been patched in 3.2.0.beta4 and 3.1.4...

CVE-2023-49098

Discourse-reactions is a plugin that allows user to add their reactions to the post. Data about a user's reaction notifications could be exposed. This vulnerability was patched in commit 2c26939...

Code injection

Discourse is a platform for community discussion. The message serializer uses the full list of expanded chat mentions @all and @here which can lead to a very long array of users. This issue was patched in versions 3.1.4 and beta 3.2.0.beta5...

CVE-2023-49099

Discourse has a vulnerability where under very specific circumstances secure upload URLs for posts could be accessed by guest users even when login is required. Affected versions were before patches 3.2.0.beta4 and 3.1.4; patch versions are 3.2.0.beta4 and 3.1.4. Impact involves potential exposur...

CVE-2023-49099 Discourse secure uploads accessible to guests even when login is required

Discourse is a platform for community discussion. Under very specific circumstances, secure upload URLs associated with posts can be accessed by guest users even when login is required. This vulnerability has been patched in 3.2.0.beta4 and 3.1.4...

CVE-2023-49099 Discourse secure uploads accessible to guests even when login is required

Discourse is a platform for community discussion. Under very specific circumstances, secure upload URLs associated with posts can be accessed by guest users even when login is required. This vulnerability has been patched in 3.2.0.beta4 and 3.1.4...

CVE-2023-49099 Discourse secure uploads accessible to guests even when login is required

Discourse is a platform for community discussion. Under very specific circumstances, secure upload URLs associated with posts can be accessed by guest users even when login is required. This vulnerability has been patched in 3.2.0.beta4 and 3.1.4...

CVE-2024-21655 Insufficient control of custom field value sizes

Discourse is a platform for community discussion. For fields that are client editable, limits on sizes are not imposed. This allows a malicious actor to cause a Discourse instance to use excessive disk space and also often excessive bandwidth. The issue is patched 3.1.4 and 3.2.0.beta4...

CVE-2024-21655 Insufficient control of custom field value sizes

Discourse is a platform for community discussion. For fields that are client editable, limits on sizes are not imposed. This allows a malicious actor to cause a Discourse instance to use excessive disk space and also often excessive bandwidth. The issue is patched 3.1.4 and 3.2.0.beta4...

CVE-2024-21655

CVE-2024-21655 affects Discourse: a vulnerability where fields editable on the client side have no imposed size limits, allowing an attacker to drive a Discourse instance to consume excessive disk space and bandwidth. Root cause is insufficient constraint on input sizes for client-editable fields...

CVE-2023-49098

CVE-2023-49098 affects the Discourse-Reactions plugin for Discourse. Data about a user’s reaction notifications could be exposed; this was mitigated by patch commit 2c26939. The CVSSv3.1 base metrics from the record are: AV:N/AC:L/PR:L/UI:R/S:U, Confidentiality Impact: Low, Integrity/Availability...

CVE-2023-49098 Reaction data for user notifications exposed in Discourse-reactions

Discourse-reactions is a plugin that allows user to add their reactions to the post. Data about a user's reaction notifications could be exposed. This vulnerability was patched in commit 2c26939...