PT-2023-26175

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.0.6 of the stable branch Discourse versions prior to 3.1.0.beta7 of the beta and tests-passed branches Description Discourse is an open source discussion platform. A malicious user can edit a post in a topic and...

CVE-2023-38684: Allocation of Resources Without Limits or Throttling

Discourse is an open source discussion platform. Prior to version 3.0.6 of the stable branch and version 3.1.0.beta7 of the beta and tests-passed branches, in multiple controller actions, Discourse accepts limit params but does not impose any upper bound on the values being accepted. Without an...

CVE-2023-37904: Concurrent Execution using Shared Resource with Improper Synchronization

Discourse is an open source discussion platform. Prior to version 3.0.6 of the stable branch and version 3.1.0.beta7 of the beta and tests-passed branches, more users than permitted could be created from invite links. The issue is patched in version 3.0.6 of the stable branch and version...

CVE-2023-38498: Uncontrolled Resource Consumption

Discourse is an open source discussion platform. Prior to version 3.0.6 of the stable branch and version 3.1.0.beta7 of the beta and tests-passed branches, a malicious user can prevent the defer queue from proceeding promptly on sites hosted in the same multisite installation. The issue is patche...

CVE-2023-38685: Exposure of Sensitive Information to an Unauthorized Actor

Discourse is an open source discussion platform. Prior to version 3.0.6 of the stable branch and version 3.1.0.beta7 of the beta and tests-passed branches, information about restricted-visibility topic tags could be obtained by unauthorized users. The issue is patched in version 3.0.6 of the stab...

CVE-2023-37906: Allocation of Resources Without Limits or Throttling

Discourse is an open source discussion platform. Prior to version 3.0.6 of the stable branch and version 3.1.0.beta7 of the beta and tests-passed branches, a malicious user can edit a post in a topic and cause a DoS with a carefully crafted edit reason. The issue is patched in version 3.0.6 of th...

CVE-2023-37467: Reusing a Nonce, Key Pair in Encryption

Discourse is an open source discussion platform. Prior to version 3.1.0.beta7 of the beta and tests-passed branches, a CSP Content Security Policy nonce reuse vulnerability was discovered could allow cross-site scripting XSS attacks to bypass CSP protection for anonymous i.e. unauthenticated user...

Discourse 安全漏洞

Discourse is an open source community discussion platform. The platform includes community, email, and chat room features. A security vulnerability exists in Discourse that stems from the fact that in multiple controller operations, Discourse accepts limiting parameters but does not impose any...

PT-2023-26549 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.0.6 of the stable branch and version 3.1.0.beta7 of the beta and tests-passed branches. Description: Discourse is an open source discussion platform. Information about restricted-visibility topic tags could be...

The vulnerability of the Discourse mailing list management software lies in the insufficient verification of input data, allowing attackers to compromise the integrity and accessibility of the protected information.

The vulnerability of the Discourse mailing list management software is related to insufficient validation of input data during the processing of topic headers. Exploitation of this vulnerability could allow a malicious actor to compromise the integrity and accessibility of the protected informati...

Discourse 3.1.0beta5 DoS Vulnerability (GHSA-gxqx-3q2p-37gm)

Discourse is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:discourse:discourse"...

Discourse cross-site scripting vulnerability (CNVD-2023-60471)

Discourse is an open source community discussion platform. The platform includes features such as community, email and chat rooms. Discourse suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of user-supplied data, which ca...

CVE-2023-36466

Discourse is an open source discussion platform. When editing a topic, there is a vulnerability that enables a user to bypass the topic title validations for things like title length, number of emojis in title and blank topic titles. The issue is patched in the latest stable, beta and tests-passe...

Design/Logic Flaw

Discourse is an open source discussion platform. In affected versions a request to create or update custom sidebar section can cause a denial of service. This issue has been patched in commit 52b003d915. Users are advised to upgrade. There are no known workarounds for this vulnerability...

Design/Logic Flaw

Discourse is an open source discussion platform. When editing a topic, there is a vulnerability that enables a user to bypass the topic title validations for things like title length, number of emojis in title and blank topic titles. The issue is patched in the latest stable, beta and tests-passe...

CVE-2023-36818 Denial of service via User Custom Sidebar Section Unlimited Link Creation in discourse

Discourse is an open source discussion platform. In affected versions a request to create or update custom sidebar section can cause a denial of service. This issue has been patched in commit 52b003d915. Users are advised to upgrade. There are no known workarounds for this vulnerability...

CVE-2023-36818 Denial of service via User Custom Sidebar Section Unlimited Link Creation in discourse

Discourse is an open source discussion platform. In affected versions a request to create or update custom sidebar section can cause a denial of service. This issue has been patched in commit 52b003d915. Users are advised to upgrade. There are no known workarounds for this vulnerability...

CVE-2023-36818

CVE-2023-36818 affects Discourse (open source discussion platform). Affected versions allow a request to create or update a custom sidebar section to trigger a denial of service. The issue is mitigated by the patch in commit 52b003d915, with upgrade advised. Some sources also reference specific v...

CVE-2023-36818 Denial of service via User Custom Sidebar Section Unlimited Link Creation in discourse

Discourse is an open source discussion platform. In affected versions a request to create or update custom sidebar section can cause a denial of service. This issue has been patched in commit 52b003d915. Users are advised to upgrade. There are no known workarounds for this vulnerability...

CVE-2023-36466 Topic Title Validation Skipped When Changing Category in Discourse

Discourse is an open source discussion platform. When editing a topic, there is a vulnerability that enables a user to bypass the topic title validations for things like title length, number of emojis in title and blank topic titles. The issue is patched in the latest stable, beta and tests-passe...