Multisite denial of service through unsanitized dynamic dispatch to SiteSetting in Discourse
Résumé
Multisite denial of service through unsanitized dynamic dispatch to SiteSetting in Discourse
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Discourse is an open source platform for community discussion. In affected versions a user logged as an administrator can call arbitrary methods on the SiteSetting class, notably #clear_cache! and #notify_changed!, which when done on a multisite instance, can affect the entire cluster resulting in a denial of service. Users not running in multisite environments are not affected. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Références
- advisory github.com
- web nvd.nist.gov