Discourse user profile location and website fields were not sufficiently length-limited
Résumé
Discourse user profile location and website fields were not sufficiently length-limited
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Discourse is an open source discussion platform. In versions prior to 2.8.9 on the stable branch and prior to 2.9.0.beta10 on the beta and tests-passed branches, a malicious actor can add large payloads of text into the Location and Website fields of a user profile, which causes issues for other users when loading that profile. A fix to limit the length of user input for these fields is included in version 2.8.9 on the stable branch and version 2.9.0.beta10 on the beta and tests-passed branches. There are no known workarounds.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Références
- advisory github.com
- advisory github.com
- advisory github.com
- web nvd.nist.gov