CVE-2023-22739 — Discourse subject to Allocation of Resources Without Limits or Throttling

Description (CNA)

Discourse is an open source platform for community discussion. Versions prior to 3.0.1 (stable), 3.1.0.beta2 (beta), and 3.1.0.beta2 (tests-passed) are subject to Allocation of Resources Without Limits or Throttling. As there is no limit on data contained in a draft, a malicious user can create an arbitrarily large draft, forcing the instance to a crawl. This issue is patched in versions 3.0.1 (stable), 3.1.0.beta2 (beta), and 3.1.0.beta2 (tests-passed). There are no workarounds.

Affected (CNA)

Vendor / product	Versions
discourse / discourse	affected stable < 3.0.1; affected beta < 3.1.0.beta2; affected tests-passed <3.1.0.beta2

CWE

CWE-770

References

https://github.com/discourse/discourse/security/advisories/GHSA-rqgr-g6v7-jcfc

ADP enrichment

CVE

No English description supplied.

https://github.com/discourse/discourse/security/advisories/GHSA-rqgr-g6v7-jcfc

CISA-ADP

No English description supplied.

No references supplied.