Description (CNA)
Discourse is an open source platform for community discussion. In affected versions users that are allowed to invite others can inject arbitrarily large data in parameters used in the invite route. The problem has been patched in the latest version of Discourse. Users are advised to upgrade. Users unable to upgrade should disable invites or restrict access to them using the `invite allowed groups` site setting.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| discourse / discourse | affected stable <= 3.2.0; affected beta <= 3.3.0.beta1; affected tests-passed <= 3.3.0.beta1 |
CWE
CWE-400
References
- https://github.com/discourse/discourse/security/advisories/GHSA-cvp5-h7p8-mjj6
- https://github.com/discourse/discourse/commit/62ea382247c1f87361d186392c45ca74c83be295
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.