CVE-2023-23616

Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and 3.1.0.beta2 on the `beta` and `tests-passed` branches, when submitting a membership request, there is no character limit for the reason provided with the request. This could potentially allow a user to flood the database with a large amount of data. However it is unlikely this could be used as part of a DoS attack, as the paths reading back the reasons are only available to administrators. Starting in version 3.0.1 on the `stable` branch and 3.1.0.beta2 on the `beta` and `tests-passed` branches, a limit of 280 characters has been introduced for membership requests.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
3.5 LOW
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
GitHub_MCNA
3.5 LOW
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
CVEADP
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 21%
VendorProductVersion
discoursediscourse
𝑥
< 3.0.1
discoursediscourse
1.1.0:beta1
discoursediscourse
1.1.0:beta2
discoursediscourse
1.1.0:beta3
discoursediscourse
1.1.0:beta4
discoursediscourse
1.1.0:beta5
discoursediscourse
1.1.0:beta6
discoursediscourse
1.1.0:beta6b
discoursediscourse
1.1.0:beta7
discoursediscourse
1.1.0:beta8
discoursediscourse
1.2.0:beta1
discoursediscourse
1.2.0:beta2
discoursediscourse
1.2.0:beta3
discoursediscourse
1.2.0:beta4
discoursediscourse
1.2.0:beta5
discoursediscourse
1.2.0:beta6
discoursediscourse
1.2.0:beta7
discoursediscourse
1.2.0:beta8
discoursediscourse
1.2.0:beta9
discoursediscourse
1.3.0:beta1
discoursediscourse
1.3.0:beta10
discoursediscourse
1.3.0:beta11
discoursediscourse
1.3.0:beta2
discoursediscourse
1.3.0:beta3
discoursediscourse
1.3.0:beta4
discoursediscourse
1.3.0:beta5
discoursediscourse
1.3.0:beta6
discoursediscourse
1.3.0:beta7
discoursediscourse
1.3.0:beta8
discoursediscourse
1.3.0:beta9
discoursediscourse
1.4.0:beta1
discoursediscourse
1.4.0:beta10
discoursediscourse
1.4.0:beta11
discoursediscourse
1.4.0:beta12
discoursediscourse
1.4.0:beta2
discoursediscourse
1.4.0:beta3
discoursediscourse
1.4.0:beta4
discoursediscourse
1.4.0:beta5
discoursediscourse
1.4.0:beta6
discoursediscourse
1.4.0:beta7
discoursediscourse
1.4.0:beta8
discoursediscourse
1.4.0:beta9
discoursediscourse
1.5.0:beta1
discoursediscourse
1.5.0:beta10
discoursediscourse
1.5.0:beta11
discoursediscourse
1.5.0:beta12
discoursediscourse
1.5.0:beta13
discoursediscourse
1.5.0:beta13b
discoursediscourse
1.5.0:beta14
discoursediscourse
1.5.0:beta2
discoursediscourse
1.5.0:beta3
discoursediscourse
1.5.0:beta4
discoursediscourse
1.5.0:beta5
discoursediscourse
1.5.0:beta6
discoursediscourse
1.5.0:beta7
discoursediscourse
1.5.0:beta8
discoursediscourse
1.5.0:beta9
discoursediscourse
1.6.0:beta1
discoursediscourse
1.6.0:beta10
discoursediscourse
1.6.0:beta11
discoursediscourse
1.6.0:beta12
discoursediscourse
1.6.0:beta2
discoursediscourse
1.6.0:beta3
discoursediscourse
1.6.0:beta4
discoursediscourse
1.6.0:beta5
discoursediscourse
1.6.0:beta6
discoursediscourse
1.6.0:beta7
discoursediscourse
1.6.0:beta8
discoursediscourse
1.6.0:beta9
discoursediscourse
1.7.0:beta1
discoursediscourse
1.7.0:beta10
discoursediscourse
1.7.0:beta11
discoursediscourse
1.7.0:beta2
discoursediscourse
1.7.0:beta3
discoursediscourse
1.7.0:beta4
discoursediscourse
1.7.0:beta5
discoursediscourse
1.7.0:beta6
discoursediscourse
1.7.0:beta7
discoursediscourse
1.7.0:beta8
discoursediscourse
1.7.0:beta9
discoursediscourse
1.8.0:beta1
discoursediscourse
1.8.0:beta10
discoursediscourse
1.8.0:beta11
discoursediscourse
1.8.0:beta12
discoursediscourse
1.8.0:beta13
discoursediscourse
1.8.0:beta2
discoursediscourse
1.8.0:beta3
discoursediscourse
1.8.0:beta4
discoursediscourse
1.8.0:beta5
discoursediscourse
1.8.0:beta6
discoursediscourse
1.8.0:beta7
discoursediscourse
1.8.0:beta8
discoursediscourse
1.8.0:beta9
discoursediscourse
1.9.0:beta1
discoursediscourse
1.9.0:beta10
discoursediscourse
1.9.0:beta11
discoursediscourse
1.9.0:beta12
discoursediscourse
1.9.0:beta13
discoursediscourse
1.9.0:beta14
discoursediscourse
1.9.0:beta15
discoursediscourse
1.9.0:beta16
discoursediscourse
1.9.0:beta17
discoursediscourse
1.9.0:beta2
discoursediscourse
1.9.0:beta3
discoursediscourse
1.9.0:beta4
discoursediscourse
1.9.0:beta5
discoursediscourse
1.9.0:beta6
discoursediscourse
1.9.0:beta7
discoursediscourse
1.9.0:beta8
discoursediscourse
1.9.0:beta9
discoursediscourse
2.0.0:beta1
discoursediscourse
2.0.0:beta10
discoursediscourse
2.0.0:beta2
discoursediscourse
2.0.0:beta3
discoursediscourse
2.0.0:beta4
discoursediscourse
2.0.0:beta5
discoursediscourse
2.0.0:beta6
discoursediscourse
2.0.0:beta7
discoursediscourse
2.0.0:beta8
discoursediscourse
2.0.0:beta9
discoursediscourse
2.1.0:beta1
discoursediscourse
2.1.0:beta2
discoursediscourse
2.1.0:beta3
discoursediscourse
2.1.0:beta4
discoursediscourse
2.1.0:beta5
discoursediscourse
2.1.0:beta6
discoursediscourse
2.2.0:beta1
discoursediscourse
2.2.0:beta10
discoursediscourse
2.2.0:beta2
discoursediscourse
2.2.0:beta3
discoursediscourse
2.2.0:beta4
discoursediscourse
2.2.0:beta5
discoursediscourse
2.2.0:beta6
discoursediscourse
2.2.0:beta7
discoursediscourse
2.2.0:beta8
discoursediscourse
2.2.0:beta9
discoursediscourse
2.3.0:beta1
discoursediscourse
2.3.0:beta10
discoursediscourse
2.3.0:beta11
discoursediscourse
2.3.0:beta2
discoursediscourse
2.3.0:beta3
discoursediscourse
2.3.0:beta4
discoursediscourse
2.3.0:beta5
discoursediscourse
2.3.0:beta6
discoursediscourse
2.3.0:beta7
discoursediscourse
2.3.0:beta8
discoursediscourse
2.3.0:beta9
discoursediscourse
2.4.0:beta1
discoursediscourse
2.4.0:beta10
discoursediscourse
2.4.0:beta11
discoursediscourse
2.4.0:beta2
discoursediscourse
2.4.0:beta3
discoursediscourse
2.4.0:beta4
discoursediscourse
2.4.0:beta5
discoursediscourse
2.4.0:beta6
discoursediscourse
2.4.0:beta7
discoursediscourse
2.4.0:beta8
discoursediscourse
2.4.0:beta9
discoursediscourse
2.5.0:beta1
discoursediscourse
2.5.0:beta2
discoursediscourse
2.5.0:beta3
discoursediscourse
2.5.0:beta4
discoursediscourse
2.5.0:beta5
discoursediscourse
2.5.0:beta6
discoursediscourse
2.5.0:beta7
discoursediscourse
2.6.0:beta1
discoursediscourse
2.6.0:beta2
discoursediscourse
2.6.0:beta3
discoursediscourse
2.6.0:beta4
discoursediscourse
2.6.0:beta5
discoursediscourse
2.6.0:beta6
discoursediscourse
2.7.0:beta1
discoursediscourse
2.7.0:beta2
discoursediscourse
2.7.0:beta3
discoursediscourse
2.7.0:beta4
discoursediscourse
2.7.0:beta5
discoursediscourse
2.7.0:beta6
discoursediscourse
2.7.0:beta7
discoursediscourse
2.7.0:beta8
discoursediscourse
2.7.0:beta9
discoursediscourse
2.8.0:beta1
discoursediscourse
2.8.0:beta10
discoursediscourse
2.8.0:beta11
discoursediscourse
2.8.0:beta2
discoursediscourse
2.8.0:beta3
discoursediscourse
2.8.0:beta4
discoursediscourse
2.8.0:beta5
discoursediscourse
2.8.0:beta6
discoursediscourse
2.8.0:beta7
discoursediscourse
2.8.0:beta8
discoursediscourse
2.8.0:beta9
discoursediscourse
2.9.0:beta1
discoursediscourse
2.9.0:beta10
discoursediscourse
2.9.0:beta11
discoursediscourse
2.9.0:beta12
discoursediscourse
2.9.0:beta13
discoursediscourse
2.9.0:beta14
discoursediscourse
2.9.0:beta2
discoursediscourse
2.9.0:beta3
discoursediscourse
2.9.0:beta4
discoursediscourse
2.9.0:beta5
discoursediscourse
2.9.0:beta6
discoursediscourse
2.9.0:beta7
discoursediscourse
2.9.0:beta8
discoursediscourse
2.9.0:beta9
discoursediscourse
3.0.0:beta15
discoursediscourse
3.0.0:beta16
discoursediscourse
3.1.0:beta1
𝑥
= Vulnerable software versions