Log in Start free

Vulnerability · Published Nov 10, 2023 · Assigned by GitHub_M

CVE-2023-45806Discourse vulnerable to DoS via Regexp Injection in Full Name

Medium 4.3

In plain English

A medium-severity regular-expression denial of service in discourse from discourse. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)1.0%top 37.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, if a user has been quoted and uses a `|` in their full name, they might be able to trigger a bug that generates a lot of duplicate content in all the posts they've been quoted by updating their full name again. Version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches contain a patch for this issue. No known workaround exists, although one can stop the "bleeding" by ensuring users only use alphanumeric characters in their full name field.

Affected products (as reported)

VendorProductVersions
discourse discourse < 3.1.3>= 3.2.0.beta0, < 3.2.0.beta3

Weakness: CWE-1333 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

References