Vulnerability · Published Jan 12, 2024 · Assigned by GitHub_M

CVE-2023-48297Discourse vulnerable to unlimited mentioned users in message serializer

High 8.6

In plain English

A high-severity uncontrolled resource consumption in discourse from discourse. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)8.6High

Exploit odds (30 days)0.5%top 55.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Discourse is a platform for community discussion. The message serializer uses the full list of expanded chat mentions (@all and @here) which can lead to a very long array of users. This issue was patched in versions 3.1.4 and beta 3.2.0.beta5.

Affected products (as reported)

Vendor	Product	Versions
discourse	discourse	< 3.1.4>= 3.2.0beta1, < 3.2.0.beta4

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

References

https://github.com/discourse/discourse/security/advisories/GHSA-hf2v-r5xm-8p37 x_refsource_CONFIRM