Skip to content

DOS through topic drafts

Moderate
pmusaraj published GHSA-rqgr-g6v7-jcfc Jan 25, 2023

Package

No package listed

Affected versions

stable <= 3.0; beta <= 3.1.0.beta1; tests-passed <= 3.1.0.beta1

Patched versions

stable >= 3.0.1; beta >= 3.1.0.beta2; tests-passed >= 3.1.0.beta2

Description

Impact

As there is no limit on data contained in a draft, a malicious user could use this to their advantage to make an instance comes to a crawl.

Patches

This issue is patched in the latest stable, beta and tests-passed versions of Discourse.

Workarounds

None.

Severity

Moderate
5.7
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

CVE ID

CVE-2023-22739

Weaknesses

No CWEs