CVE-2022-23549CWE-20

Discourse vulnerable to bypass of post max_length using HTML comments

Medium · published January 5, 2023

CVSS v3.1
5.7
EPSS
1%
Percentile
47.8
In the wild
Unconfirmed
What it is

Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 2.9.0.beta16 on the `beta` and `tests-passed` branches, users can create posts with raw body longer than the `max_length` site setting by including html comments that are not counted toward the character limit. This issue is patched in versions 2.8.14 and 2.9.0.beta16. There are no known workarounds.

The record
Technical detail
CVSS v3.1
5.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00596 · 47.8th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2023-01-05T00:00Z
EPSS history
Timeline
  • 05 JAN 00:00Z
    Discourse vulnerable to bypass of post max_length using HTML comments
    cvelistv5