CVE-2023-38706

Discourse vulnerable to DoS via drafts

State: Published
Severity: 6.5 Medium
Published: Sep 15, 2023
Updated: Sep 24, 2024
Reserved: Jul 24, 2023

Description

Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branches, a malicious user can create an unlimited number of drafts with very long draft keys which may end up exhausting the resources on the server. The issue is patched in version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branches. There are no known workarounds.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	GitHub_M

Weaknesses

CWE-770 Allocation of Resources Without Limits or Throttling

Affected Products

Product	Versions
discoursediscourse	stable < 3.1.1Affected beta < 3.2.0.beta1Affected tests-passed < 3.2.0.beta1Affected

References

https://github.com/discourse/discourse/security/advisories/GHSA-7wpp-4pqg-gvp8

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.