CVE-2023-48297

Discourse is a platform for community discussion. The message serializer uses the full list of expanded chat mentions (@all and @here) which can lead to a very long array of users. This issue was patched in versions 3.1.4 and beta 3.2.0.beta5.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*
cpe:2.3:a:discourse:discourse:3.2.0:beta1:*:*:beta:*:*:*
cpe:2.3:a:discourse:discourse:3.2.0:beta2:*:*:beta:*:*:*
cpe:2.3:a:discourse:discourse:3.2.0:beta3:*:*:beta:*:*:*

History

25 Jan 2024, 15:42

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 7.5
First Time Discourse
Discourse discourse
CPE cpe:2.3:a:discourse:discourse:3.2.0:beta3:*:*:beta:*:*:*
cpe:2.3:a:discourse:discourse:3.2.0:beta1:*:*:beta:*:*:*
cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*
cpe:2.3:a:discourse:discourse:3.2.0:beta2:*:*:beta:*:*:*
References () https://github.com/discourse/discourse/security/advisories/GHSA-hf2v-r5xm-8p37 - () https://github.com/discourse/discourse/security/advisories/GHSA-hf2v-r5xm-8p37 - Vendor Advisory
CWE CWE-400 NVD-CWE-Other

12 Jan 2024, 21:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-01-12 21:15

Updated : 2024-02-28 20:54


NVD link : CVE-2023-48297

Mitre link : CVE-2023-48297

CVE.ORG link : CVE-2023-48297


JSON object : View

Products Affected

discourse

  • discourse
CWE
NVD-CWE-Other CWE-400

Uncontrolled Resource Consumption