CVE-2023-40588 Discourse DoS via 2FA and Security Key Names

Discourse is an open-source discussion platform. Prior to version 3.1.1 of the stable branch and version 3.2.0.beta1 of the beta and tests-passed branches, a malicious user could add a 2FA or security key with a carefully crafted name to their account and cause a denial of service for other users...

CVE-2023-40588 Discourse DoS via 2FA and Security Key Names

Discourse is an open-source discussion platform. Prior to version 3.1.1 of the stable branch and version 3.2.0.beta1 of the beta and tests-passed branches, a malicious user could add a 2FA or security key with a carefully crafted name to their account and cause a denial of service for other users...

CVE-2023-40588

CVE-2023-40588 affects Discourse (open-source discussion platform). A malicious user could add a 2FA or security key with a crafted name, causing a denial-of-service for other users. Affected versions: prior to 3.1.1 on the stable branch and 3.2.0.beta1 on the beta/tests-passed branches. Mitigati...

CVE-2023-40588 Discourse DoS via 2FA and Security Key Names

Discourse is an open-source discussion platform. Prior to version 3.1.1 of the stable branch and version 3.2.0.beta1 of the beta and tests-passed branches, a malicious user could add a 2FA or security key with a carefully crafted name to their account and cause a denial of service for other users...

CVE-2023-38706 Discourse vulnerable to DoS via drafts

Discourse is an open-source discussion platform. Prior to version 3.1.1 of the stable branch and version 3.2.0.beta1 of the beta and tests-passed branches, a malicious user can create an unlimited number of drafts with very long draft keys which may end up exhausting the resources on the server...

CVE-2023-38706

Discourse (open‑source forum software) contains a DoS vulnerability (CVE-2023-38706) where a malicious user can create an unlimited number of drafts with very long draft keys, exhausting server resources. Affected are stable branch < 3.1.1 and beta/tests-passed branches

CVE-2023-38706 Discourse vulnerable to DoS via drafts

Discourse is an open-source discussion platform. Prior to version 3.1.1 of the stable branch and version 3.2.0.beta1 of the beta and tests-passed branches, a malicious user can create an unlimited number of drafts with very long draft keys which may end up exhausting the resources on the server...

CVE-2023-38706 Discourse vulnerable to DoS via drafts

Discourse is an open-source discussion platform. Prior to version 3.1.1 of the stable branch and version 3.2.0.beta1 of the beta and tests-passed branches, a malicious user can create an unlimited number of drafts with very long draft keys which may end up exhausting the resources on the server...

PT-2023-26570

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.1.1 Discourse version 3.2.0.beta1 and earlier in the beta and tests-passed branches Description A malicious user can create an unlimited number of drafts with very long draft keys, potentially exhausting server...

Discourse Security Breach

Discourse is an open source community discussion platform. The platform includes features such as communities, email and chat rooms. A security vulnerability exists in versions prior to Discourse 3.1.1. An attacker exploiting this vulnerability could perform a denial-of-service attack...

Discourse Security Breach

Discourse is an open source community discussion platform. The platform includes features such as communities, email and chat rooms. A security vulnerability exists in versions prior to Discourse 3.1.1 that stems from not enforcing file size or number file limits...

Discourse Security Breach

Discourse is an open source community discussion platform. The platform includes features such as communities, e-mail and chat rooms. A security vulnerability exists in Discourse, which stems from a vulnerability that allows an attacker to create an unlimited number of drafts by using a long draf...

CVE-2023-40588: Allocation of Resources Without Limits or Throttling

Discourse is an open-source discussion platform. Prior to version 3.1.1 of the stable branch and version 3.2.0.beta1 of the beta and tests-passed branches, a malicious user could add a 2FA or security key with a carefully crafted name to their account and cause a denial of service for other users...

CVE-2023-38706: Allocation of Resources Without Limits or Throttling

Discourse is an open-source discussion platform. Prior to version 3.1.1 of the stable branch and version 3.2.0.beta1 of the beta and tests-passed branches, a malicious user can create an unlimited number of drafts with very long draft keys which may end up exhausting the resources on the server...

CVE-2023-41042: Allocation of Resources Without Limits or Throttling

Discourse is an open-source discussion platform. Prior to version 3.1.1 of the stable branch and version 3.2.0.beta1 of the beta and tests-passed branches, importing a remote theme loads their assets into memory without enforcing limits for file size or number of files. The issue is patched in...

CVE-2023-41043: Allocation of Resources Without Limits or Throttling

Discourse is an open-source discussion platform. Prior to version 3.1.1 of the stable branch and version 3.2.0.beta1 of the beta and tests-passed branches, a malicious admin could create extremely large icons sprites, which would then be cached in each server process. This may cause server...

Discourse Security Breach

Discourse is an open source community discussion platform. The platform includes community, email and chat room features. A security vulnerability exists in versions prior to Discourse 3.1.1. An attacker exploited the vulnerability to cause a process halt...

PT-2023-27756 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.1.1 of the stable branch Discourse versions prior to 3.2.0.beta1 of the beta and tests-passed branches Description: A malicious admin could create extremely large icons sprites, which would then be cached in each...

PT-2023-27524 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.1.1 Discourse version 3.2.0.beta1 and earlier in the beta and tests-passed branches Description: A malicious user could add a 2FA or security key with a carefully crafted name to their account, causing a denial o...

The Inability to Simultaneously Verify Sentience, Location, and Identity

Really interesting "systematization of knowledge" paper: "SoK: The Ghost Trilemma" Abstract: Trolls, bots, and sybils distort online discourse and compromise the security of networked platforms. User identity is central to the vectors of attack and manipulation employed in these contexts. However...