Skip to content

Multisite DoS through unsanitized dynamic dispatch to SiteSetting

Moderate
nattsw published GHSA-jj93-w3mv-3jvv Apr 18, 2023

Package

No package listed

Affected versions

stable <= 3.0.1; beta <= 3.1.0.beta2; tests-passed <= 3.1.0.beta2

Patched versions

stable > 3.0.1; beta > 3.1.0.beta2; tests-passed > 3.1.0.beta2

Description

Impact

A user logged as an administrator can call arbitrary methods on the SiteSetting class, notably #clear_cache! and #notify_changed!, which when done on a multisite, can affect the entire cluster.

Patches

This issue is patched in the latest stable, beta and tests-passed versions of Discourse.

Workarounds

None.

Severity

Moderate
4.5
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
High
User interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H

CVE ID

CVE-2023-30606

Weaknesses

No CWEs