CVE-2024-27100 Denial of service via Staff Actions in Discourse

Discourse is an open source platform for community discussion. In affected versions the endpoints for suspending users, silencing users and exporting CSV files weren't enforcing limits on the sizes of the parameters that they accept. This could lead to excessive resource consumption which could...

CVE-2024-27100

CVE-2024-27100 affects Discourse. The vulnerability lies in the endpoints for suspending users, silencing users, and exporting CSV files which do not enforce limits on parameter sizes, enabling potential excessive resource consumption that could render an instance inoperable. Impact is described ...

CVE-2024-27100 Denial of service via Staff Actions in Discourse

Discourse is an open source platform for community discussion. In affected versions the endpoints for suspending users, silencing users and exporting CSV files weren't enforcing limits on the sizes of the parameters that they accept. This could lead to excessive resource consumption which could...

CVE-2024-28242 Disclosure of the existence of secret categories with custom backgrounds in Discourse

Discourse is an open source platform for community discussion. In affected versions an attacker can learn that secret categories exist when they have backgrounds set. The issue is patched in the latest stable, beta and tests-passed version of Discourse. Users are advised to upgrade. Users unable ...

CVE-2024-28242 Disclosure of the existence of secret categories with custom backgrounds in Discourse

Discourse is an open source platform for community discussion. In affected versions an attacker can learn that secret categories exist when they have backgrounds set. The issue is patched in the latest stable, beta and tests-passed version of Discourse. Users are advised to upgrade. Users unable ...

CVE-2024-28242 Disclosure of the existence of secret categories with custom backgrounds in Discourse

Discourse is an open source platform for community discussion. In affected versions an attacker can learn that secret categories exist when they have backgrounds set. The issue is patched in the latest stable, beta and tests-passed version of Discourse. Users are advised to upgrade. Users unable ...

CVE-2024-28242

Discourse (open source platform) is affected by CVE-2024-28242: an attacker can learn that secret categories exist when category backgrounds are set. Root cause is exposure via background metadata in affected versions. The issue is fixed in the latest stable, beta, and tests-passed Discourse rele...

CVE-2024-24748 Disclosure of the existence of secret subcategories in Discourse

Discourse is an open source platform for community discussion. In affected versions an attacker can learn that a secret subcategory exists under a public category which has no public subcategories. The issue is patched in the latest stable, beta and tests-passed version of Discourse. Users are...

CVE-2024-24748 Disclosure of the existence of secret subcategories in Discourse

Discourse is an open source platform for community discussion. In affected versions an attacker can learn that a secret subcategory exists under a public category which has no public subcategories. The issue is patched in the latest stable, beta and tests-passed version of Discourse. Users are...

CVE-2024-24748

CVE-2024-24748 affects Discourse. The vulnerability allows an attacker to learn that a secret subcategory exists under a public category that has no public subcategories. The issue is mitigated by upgrading to the latest stable, beta, or tests-passed Discourse release, as documented in multiple a...

CVE-2024-24748 Disclosure of the existence of secret subcategories in Discourse

Discourse is an open source platform for community discussion. In affected versions an attacker can learn that a secret subcategory exists under a public category which has no public subcategories. The issue is patched in the latest stable, beta and tests-passed version of Discourse. Users are...

CVE-2024-24827

Discourse (open source forum software) is vulnerable to a Denial of Service caused by no rate limit on POST /uploads. The CVE-2024-24827 entry notes that creating an upload is resource-intensive, and impact varies by site settings such as max_image_size_kb, max_attachment_size_kb, and max_image_m...

CVE-2024-24827 No rate limits on POST /uploads endpoint in Discourse

Discourse is an open source platform for community discussion. Without a rate limit on the POST /uploads endpoint, it makes it easier for an attacker to carry out a DoS attack on the server since creating an upload can be a resource intensive process. Do note that the impact varies from site to...

CVE-2024-24827 No rate limits on POST /uploads endpoint in Discourse

Discourse is an open source platform for community discussion. Without a rate limit on the POST /uploads endpoint, it makes it easier for an attacker to carry out a DoS attack on the server since creating an upload can be a resource intensive process. Do note that the impact varies from site to...

CVE-2024-24827 No rate limits on POST /uploads endpoint in Discourse

Discourse is an open source platform for community discussion. Without a rate limit on the POST /uploads endpoint, it makes it easier for an attacker to carry out a DoS attack on the server since creating an upload can be a resource intensive process. Do note that the impact varies from site to...

Discourse 安全漏洞

Discourse is an open source community discussion platform. The platform includes features such as community, email and chat rooms. Discourse suffers from a denial of service vulnerability that stems from the POST /uploads endpoint not being rate-limited. An attacker could exploit this vulnerabili...

PT-2024-20527 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to the latest stable, beta and tests-passed version Description: The issue allows an attacker to discover the existence of a secret subcategory under a public category with no public subcategories. There are no known...

PT-2024-21637

Name of the Vulnerable Software and Affected Versions Discourse versions prior to the latest version Description The issue affects Discourse, an open source platform for community discussion. Users allowed to invite others can inject arbitrarily large data in parameters used in the invite route...

PT-2024-22357

Name of the Vulnerable Software and Affected Versions Discourse versions prior to the latest stable, beta and tests-passed version Description The issue allows an attacker to discover the existence of secret categories when they have backgrounds set. This is a problem in an open source platform f...

CVE-2024-27085: Uncontrolled Resource Consumption

Discourse is an open source platform for community discussion. In affected versions users that are allowed to invite others can inject arbitrarily large data in parameters used in the invite route. The problem has been patched in the latest version of Discourse. Users are advised to upgrade. User...