CVE-2022-41921
28.11.2022, 15:15
Discourse is an open-source discussion platform. Prior to version 2.9.0.beta13, users can post chat messages of an unlimited length, which can cause a denial of service for other users when posting huge amounts of text. Users should upgrade to version 2.9.0.beta13, where a limit has been introduced. No known workarounds are available.Enginsight
| Vendor | Product | Version |
|---|---|---|
| discourse | discourse | 𝑥 < 2.9.0 |
| discourse | discourse | 2.9.0:beta1 |
| discourse | discourse | 2.9.0:beta10 |
| discourse | discourse | 2.9.0:beta11 |
| discourse | discourse | 2.9.0:beta12 |
| discourse | discourse | 2.9.0:beta2 |
| discourse | discourse | 2.9.0:beta3 |
| discourse | discourse | 2.9.0:beta4 |
| discourse | discourse | 2.9.0:beta5 |
| discourse | discourse | 2.9.0:beta6 |
| discourse | discourse | 2.9.0:beta7 |
| discourse | discourse | 2.9.0:beta8 |
| discourse | discourse | 2.9.0:beta9 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-20 - Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-770 - Allocation of Resources Without Limits or ThrottlingThe software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
References