Log in Start free

Vulnerability · Published Sep 29, 2022 · Assigned by GitHub_M

CVE-2022-39226Discourse user profile location and website fields were not sufficiently length-limited

Medium 4.3

In plain English

A medium-severity resource allocation without limits in discourse from discourse. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)1.0%top 36.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` branches, a malicious actor can add large payloads of text into the Location and Website fields of a user profile, which causes issues for other users when loading that profile. A fix to limit the length of user input for these fields is included in version 2.8.9 on the `stable` branch and version 2.9.0.beta10 on the `beta` and `tests-passed` branches. There are no known workarounds.

Affected products (as reported)

VendorProductVersions
discourse discourse < 2.8.9>= 2.9.0.beta0, < 2.9.0.beta10

Weakness: CWE-770, CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

References