Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branches, a malicious admin could create extremely large icons sprites, which would then be cached in each server process. This may cause server processes to be killed and lead to downtime. The issue is patched in version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branches. This is only a concern for multisite installations. No action is required when the admins are trusted.
Metrics
No CVSS v4.0
Attack Vector Network
Attack Complexity Low
Privileges Required Low
Scope Unchanged
Confidentiality Impact None
Integrity Impact None
Availability Impact High
User Interaction None
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploitation none
Automatable no
Technical Impact partial
Affected Vendors & Products
Vendors | Products |
---|---|
Discourse |
|
Configuration 1 [-]
|
Configuration 2 [-]
|
No data.
References
History
Tue, 24 Sep 2024 19:30:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
ssvc
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published: 2023-09-15T19:27:59.432Z
Updated: 2024-09-24T18:13:49.117Z
Reserved: 2023-08-22T16:57:23.932Z
Link: CVE-2023-41043
Vulnrichment
Updated: 2024-08-02T18:46:11.532Z
NVD
Status : Modified
Published: 2023-09-15T20:15:10.540
Modified: 2024-11-21T08:20:26.617
Link: CVE-2023-41043
Redhat
No data.