CVE-2023-28440

Denial of service via admin theme import route in Discourse

State: Published
Severity: 2.7 Low
Published: Apr 18, 2023
Updated: Feb 6, 2025
Reserved: Mar 15, 2023

Description

Discourse is an open source platform for community discussion. In affected versions a maliciously crafted request from a Discourse administrator can lead to a long-running request and eventual timeout. This has the greatest potential impact in shared hosting environments where admins are untrusted. This issue has been addressed in versions 3.0.3 and 3.1.0.beta4. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Scores

CVSS	Score	Vector	Source
3.1	2.7 Low	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L	GitHub_M

Weaknesses

CWE-400 Uncontrolled Resource Consumption

Affected Products

Product	Versions
discoursediscourse	stable: <= 3.0.2Affected beta: <= 3.1.0.beta3Affected

References

https://github.com/discourse/discourse/security/advisories/GHSA-vm65-pv5h-6g3w

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.