CVE-2023-23620 Discourse restricted tag routes leak topic information

Discourse is an open-source discussion platform. Prior to version 3.0.1 on the stable branch and 3.1.0.beta2 on the beta and tests-passed branches, the contents of latest/top routes for restricted tags can be accessed by unauthorized users. This issue is patched in version 3.0.1 on the stable...

CVE-2023-23620

Discourse (open-source discussion platform) has a vulnerability where contents of latest/top routes for restricted tags could be accessed by unauthorized users. Affected versions are prior to 3.0.1 on the stable branch and prior to 3.1.0.beta2 on the beta/tests-passed branches. The issue is patch...

Discourse 安全漏洞

Discourse is an open source community discussion platform. The platform includes community, email and chat room features. A security vulnerability exists in Discourse versions prior to 3.0.1 stable, 3.1.0.beta2 beta and test-passed. An attacker exploited the vulnerability to cause a regular...

PT-2023-18681 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.1.0.beta1 Description: Discourse is an open source platform for community discussion. The issue concerns the allocation of resources without limits, allowing users to create chat drafts of an unlimited length. Th...

CVE-2023-23616 Discourse membership requests lack character limit

Discourse is an open-source discussion platform. Prior to version 3.0.1 on the stable branch and 3.1.0.beta2 on the beta and tests-passed branches, when submitting a membership request, there is no character limit for the reason provided with the request. This could potentially allow a user to...

Discourse 安全漏洞

Discourse is an open source community discussion platform. The platform includes features such as communities, email and chat rooms. A security vulnerability exists in versions prior to Discourse 3.1.0.beta1, which stems from improper resource allocation restrictions...

CVE-2023-23616

CVE-2023-23616 affects Discourse, where pre-fix versions permit membership-requests to include unlimited reasoning text. Specifically, versions before 3.0.1 on the stable branch and before 3.1.0.beta2 on the beta/tests-passed branches lack a character limit for the request reason, enabling potent...

CVE-2023-23620 Discourse restricted tag routes leak topic information

Discourse is an open-source discussion platform. Prior to version 3.0.1 on the stable branch and 3.1.0.beta2 on the beta and tests-passed branches, the contents of latest/top routes for restricted tags can be accessed by unauthorized users. This issue is patched in version 3.0.1 on the stable...

CVE-2023-22739

Discourse is an open source platform for community discussion. Versions prior to 3.0.1 stable, 3.1.0.beta2 beta, and 3.1.0.beta2 tests-passed are subject to Allocation of Resources Without Limits or Throttling. As there is no limit on data contained in a draft, a malicious user can create an...

CVE-2023-22468

Discourse is an open source platform for community discussion. Versions prior to 2.8.13 stable, 3.0.0.beta16 beta and 3.0.0beta16 tests-passed, are vulnerable to cross-site Scripting. A maliciously crafted URL can be included in a post to carry out cross-site scripting attacks on sites with...

Cross site scripting

Discourse is an open source platform for community discussion. Versions prior to 2.8.13 stable, 3.0.0.beta16 beta and 3.0.0beta16 tests-passed, are vulnerable to cross-site Scripting. A maliciously crafted URL can be included in a post to carry out cross-site scripting attacks on sites with...

Command injection

Discourse is an open source platform for community discussion. Versions prior to 3.0.1 stable, 3.1.0.beta2 beta, and 3.1.0.beta2 tests-passed are subject to Allocation of Resources Without Limits or Throttling. As there is no limit on data contained in a draft, a malicious user can create an...

CVE-2023-22739

CVE-2023-22739 affects Discourse. Versions prior to 3.0.1 (stable) and 3.1.0.beta2 (beta/tests-passed) are vulnerable to unbounded draft data, enabling a malicious user to create an arbitrarily large draft and cause the instance to crawl. Root cause: Allocation of Resources Without Limits or Thro...

CVE-2023-22739 Discourse subject to Allocation of Resources Without Limits or Throttling

Discourse is an open source platform for community discussion. Versions prior to 3.0.1 stable, 3.1.0.beta2 beta, and 3.1.0.beta2 tests-passed are subject to Allocation of Resources Without Limits or Throttling. As there is no limit on data contained in a draft, a malicious user can create an...

CVE-2023-22739 Discourse subject to Allocation of Resources Without Limits or Throttling

Discourse is an open source platform for community discussion. Versions prior to 3.0.1 stable, 3.1.0.beta2 beta, and 3.1.0.beta2 tests-passed are subject to Allocation of Resources Without Limits or Throttling. As there is no limit on data contained in a draft, a malicious user can create an...

CVE-2023-22739 Discourse subject to Allocation of Resources Without Limits or Throttling

Discourse is an open source platform for community discussion. Versions prior to 3.0.1 stable, 3.1.0.beta2 beta, and 3.1.0.beta2 tests-passed are subject to Allocation of Resources Without Limits or Throttling. As there is no limit on data contained in a draft, a malicious user can create an...

CVE-2023-22468 Discourse vulnerable to Cross-site Scripting in local oneboxes

Discourse is an open source platform for community discussion. Versions prior to 2.8.13 stable, 3.0.0.beta16 beta and 3.0.0beta16 tests-passed, are vulnerable to cross-site Scripting. A maliciously crafted URL can be included in a post to carry out cross-site scripting attacks on sites with...

CVE-2023-22468

CVE-2023-22468 relates to a cross-site scripting vulnerability in Discourse. Publicly documented versions prior to 2.8.13 (stable) and 3.0.0.beta16 (beta and tests-passed) are affected by a crafted URL that can be included in a post to trigger XSS on sites with insecure CSP. Discourse’s default C...

CVE-2023-22468 Discourse vulnerable to Cross-site Scripting in local oneboxes

Discourse is an open source platform for community discussion. Versions prior to 2.8.13 stable, 3.0.0.beta16 beta and 3.0.0beta16 tests-passed, are vulnerable to cross-site Scripting. A maliciously crafted URL can be included in a post to carry out cross-site scripting attacks on sites with...

CVE-2023-22468 Discourse vulnerable to Cross-site Scripting in local oneboxes

Discourse is an open source platform for community discussion. Versions prior to 2.8.13 stable, 3.0.0.beta16 beta and 3.0.0beta16 tests-passed, are vulnerable to cross-site Scripting. A maliciously crafted URL can be included in a post to carry out cross-site scripting attacks on sites with...