CVE-2023-22740CWE-770

Discourse vulnerable to Allocation of Resources Without Limits via Chat drafts

Medium · published January 27, 2023

CVSS v3.1
4.3
EPSS
1%
Percentile
52.0
In the wild
Unconfirmed
What it is

Discourse is an open source platform for community discussion. Versions prior to 3.1.0.beta1 (beta) (tests-passed) are vulnerable to Allocation of Resources Without Limits. Users can create chat drafts of an unlimited length, which can cause a denial of service by generating an excessive load on the server. Additionally, an unlimited number of drafts were loaded when loading the user. This issue has been patched in version 2.1.0.beta1 (beta) and (tests-passed). Users should upgrade to the latest version where a limit has been introduced. There are no workarounds available.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00683 · 52.0th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2023-01-27T00:39Z
EPSS history
Timeline
  • 27 JAN 00:39Z
    Discourse vulnerable to Allocation of Resources Without Limits via Chat drafts
    cvelistv5