Discourse user profile location and website fields were not sufficiently length-limited
Summary
Discourse user profile location and website fields were not sufficiently length-limited
Original description
The description as published by the source.
Discourse is an open source discussion platform. In versions prior to 2.8.9 on the stable branch and prior to 2.9.0.beta10 on the beta and tests-passed branches, a malicious actor can add large payloads of text into the Location and Website fields of a user profile, which causes issues for other users when loading that profile. A fix to limit the length of user input for these fields is included in version 2.8.9 on the stable branch and version 2.9.0.beta10 on the beta and tests-passed branches. There are no known workarounds.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
References
- advisory github.com
- advisory github.com
- advisory github.com
- web nvd.nist.gov