CVE-2023-48297
Discourse vulnerable to unlimited mentioned users in message serializer
Summary
Discourse vulnerable to unlimited mentioned users in message serializer
Original description
The description as published by the source.
Discourse is a platform for community discussion. The message serializer uses the full list of expanded chat mentions (@all and @here) which can lead to a very long array of users. This issue was patched in versions 3.1.4 and beta 3.2.0.beta5.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Bitnami
discourse
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.1.4"}]}]
References
- advisory github.com
- web nvd.nist.gov