CVE-2023-48297
Discourse vulnerable to unlimited mentioned users in message serializer
Résumé
Discourse vulnerable to unlimited mentioned users in message serializer
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Discourse is a platform for community discussion. The message serializer uses the full list of expanded chat mentions (@all and @here) which can lead to a very long array of users. This issue was patched in versions 3.1.4 and beta 3.2.0.beta5.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Bitnami
discourse
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.1.4"}]}]
Références
- advisory github.com
- web nvd.nist.gov