CVE-2023-45806CWE-1333

Discourse vulnerable to DoS via Regexp Injection in Full Name

Medium · published November 10, 2023

CVSS v3.1
4.3
EPSS
1%
Percentile
62.4
In the wild
Unconfirmed
What it is

Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, if a user has been quoted and uses a `|` in their full name, they might be able to trigger a bug that generates a lot of duplicate content in all the posts they've been quoted by updating their full name again. Version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches contain a patch for this issue. No known workaround exists, although one can stop the "bleeding" by ensuring users only use alphanumeric characters in their full name field.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00999 · 62.4th percentile
Weakness
CWE-1333 · Inefficient Regular Expression Complexity
Published
2023-11-10T14:43Z
EPSS history
Timeline
  • 10 NOV 14:43Z
    Discourse vulnerable to DoS via Regexp Injection in Full Name
    cvelistv5