CVE-2022-23549
Discourse vulnerable to bypass of post max_length using HTML comments
概要
Discourse vulnerable to bypass of post max_length using HTML comments
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Discourse is an option source discussion platform. Prior to version 2.8.14 on the stable branch and version 2.9.0.beta16 on the beta and tests-passed branches, users can create posts with raw body longer than the max_length site setting by including html comments that are not counted toward the character limit. This issue is patched in versions 2.8.14 and 2.9.0.beta16. There are no known workarounds.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
Bitnami
discourse
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.8.14"}]}]
参照URL
- advisory github.com
- advisory github.com
- web nvd.nist.gov