CVE-2023-41042

Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branches, importing a remote theme loads their assets into memory without enforcing limits for file size or number of files. The issue is patched in version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branches. There are no known workarounds.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.9 MEDIUM
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
GitHub_MCNA
4.9 MEDIUM
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVEADP
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 16%
VendorProductVersion
discoursediscourse
𝑥
< 3.1.1
discoursediscourse
1.1.0:beta1
discoursediscourse
1.1.0:beta2
discoursediscourse
1.1.0:beta3
discoursediscourse
1.1.0:beta4
discoursediscourse
1.1.0:beta5
discoursediscourse
1.1.0:beta6
discoursediscourse
1.1.0:beta6b
discoursediscourse
1.1.0:beta7
discoursediscourse
1.1.0:beta8
discoursediscourse
1.2.0:beta1
discoursediscourse
1.2.0:beta2
discoursediscourse
1.2.0:beta3
discoursediscourse
1.2.0:beta4
discoursediscourse
1.2.0:beta5
discoursediscourse
1.2.0:beta6
discoursediscourse
1.2.0:beta7
discoursediscourse
1.2.0:beta8
discoursediscourse
1.2.0:beta9
discoursediscourse
1.3.0:beta1
discoursediscourse
1.3.0:beta10
discoursediscourse
1.3.0:beta11
discoursediscourse
1.3.0:beta2
discoursediscourse
1.3.0:beta3
discoursediscourse
1.3.0:beta4
discoursediscourse
1.3.0:beta5
discoursediscourse
1.3.0:beta6
discoursediscourse
1.3.0:beta7
discoursediscourse
1.3.0:beta8
discoursediscourse
1.3.0:beta9
discoursediscourse
1.4.0:beta1
discoursediscourse
1.4.0:beta10
discoursediscourse
1.4.0:beta11
discoursediscourse
1.4.0:beta12
discoursediscourse
1.4.0:beta2
discoursediscourse
1.4.0:beta3
discoursediscourse
1.4.0:beta4
discoursediscourse
1.4.0:beta5
discoursediscourse
1.4.0:beta6
discoursediscourse
1.4.0:beta7
discoursediscourse
1.4.0:beta8
discoursediscourse
1.4.0:beta9
discoursediscourse
1.5.0:beta1
discoursediscourse
1.5.0:beta10
discoursediscourse
1.5.0:beta11
discoursediscourse
1.5.0:beta12
discoursediscourse
1.5.0:beta13
discoursediscourse
1.5.0:beta13b
discoursediscourse
1.5.0:beta14
discoursediscourse
1.5.0:beta2
discoursediscourse
1.5.0:beta3
discoursediscourse
1.5.0:beta4
discoursediscourse
1.5.0:beta5
discoursediscourse
1.5.0:beta6
discoursediscourse
1.5.0:beta7
discoursediscourse
1.5.0:beta8
discoursediscourse
1.5.0:beta9
discoursediscourse
1.6.0:beta1
discoursediscourse
1.6.0:beta10
discoursediscourse
1.6.0:beta11
discoursediscourse
1.6.0:beta12
discoursediscourse
1.6.0:beta2
discoursediscourse
1.6.0:beta3
discoursediscourse
1.6.0:beta4
discoursediscourse
1.6.0:beta5
discoursediscourse
1.6.0:beta6
discoursediscourse
1.6.0:beta7
discoursediscourse
1.6.0:beta8
discoursediscourse
1.6.0:beta9
discoursediscourse
1.7.0:beta1
discoursediscourse
1.7.0:beta10
discoursediscourse
1.7.0:beta11
discoursediscourse
1.7.0:beta2
discoursediscourse
1.7.0:beta3
discoursediscourse
1.7.0:beta4
discoursediscourse
1.7.0:beta5
discoursediscourse
1.7.0:beta6
discoursediscourse
1.7.0:beta7
discoursediscourse
1.7.0:beta8
discoursediscourse
1.7.0:beta9
discoursediscourse
1.8.0:beta1
discoursediscourse
1.8.0:beta10
discoursediscourse
1.8.0:beta11
discoursediscourse
1.8.0:beta12
discoursediscourse
1.8.0:beta13
discoursediscourse
1.8.0:beta2
discoursediscourse
1.8.0:beta3
discoursediscourse
1.8.0:beta4
discoursediscourse
1.8.0:beta5
discoursediscourse
1.8.0:beta6
discoursediscourse
1.8.0:beta7
discoursediscourse
1.8.0:beta8
discoursediscourse
1.8.0:beta9
discoursediscourse
1.9.0:beta1
discoursediscourse
1.9.0:beta10
discoursediscourse
1.9.0:beta11
discoursediscourse
1.9.0:beta12
discoursediscourse
1.9.0:beta13
discoursediscourse
1.9.0:beta14
discoursediscourse
1.9.0:beta15
discoursediscourse
1.9.0:beta16
discoursediscourse
1.9.0:beta17
discoursediscourse
1.9.0:beta2
discoursediscourse
1.9.0:beta3
discoursediscourse
1.9.0:beta4
discoursediscourse
1.9.0:beta5
discoursediscourse
1.9.0:beta6
discoursediscourse
1.9.0:beta7
discoursediscourse
1.9.0:beta8
discoursediscourse
1.9.0:beta9
discoursediscourse
2.0.0:beta1
discoursediscourse
2.0.0:beta10
discoursediscourse
2.0.0:beta2
discoursediscourse
2.0.0:beta3
discoursediscourse
2.0.0:beta4
discoursediscourse
2.0.0:beta5
discoursediscourse
2.0.0:beta6
discoursediscourse
2.0.0:beta7
discoursediscourse
2.0.0:beta8
discoursediscourse
2.0.0:beta9
discoursediscourse
2.1.0:beta1
discoursediscourse
2.1.0:beta2
discoursediscourse
2.1.0:beta3
discoursediscourse
2.1.0:beta4
discoursediscourse
2.1.0:beta5
discoursediscourse
2.1.0:beta6
discoursediscourse
2.2.0:beta1
discoursediscourse
2.2.0:beta10
discoursediscourse
2.2.0:beta2
discoursediscourse
2.2.0:beta3
discoursediscourse
2.2.0:beta4
discoursediscourse
2.2.0:beta5
discoursediscourse
2.2.0:beta6
discoursediscourse
2.2.0:beta7
discoursediscourse
2.2.0:beta8
discoursediscourse
2.2.0:beta9
discoursediscourse
2.3.0:beta1
discoursediscourse
2.3.0:beta10
discoursediscourse
2.3.0:beta11
discoursediscourse
2.3.0:beta2
discoursediscourse
2.3.0:beta3
discoursediscourse
2.3.0:beta4
discoursediscourse
2.3.0:beta5
discoursediscourse
2.3.0:beta6
discoursediscourse
2.3.0:beta7
discoursediscourse
2.3.0:beta8
discoursediscourse
2.3.0:beta9
discoursediscourse
2.4.0:beta1
discoursediscourse
2.4.0:beta10
discoursediscourse
2.4.0:beta11
discoursediscourse
2.4.0:beta2
discoursediscourse
2.4.0:beta3
discoursediscourse
2.4.0:beta4
discoursediscourse
2.4.0:beta5
discoursediscourse
2.4.0:beta6
discoursediscourse
2.4.0:beta7
discoursediscourse
2.4.0:beta8
discoursediscourse
2.4.0:beta9
discoursediscourse
2.5.0:beta1
discoursediscourse
2.5.0:beta2
discoursediscourse
2.5.0:beta3
discoursediscourse
2.5.0:beta4
discoursediscourse
2.5.0:beta5
discoursediscourse
2.5.0:beta6
discoursediscourse
2.5.0:beta7
discoursediscourse
2.6.0:beta1
discoursediscourse
2.6.0:beta2
discoursediscourse
2.6.0:beta3
discoursediscourse
2.6.0:beta4
discoursediscourse
2.6.0:beta5
discoursediscourse
2.6.0:beta6
discoursediscourse
2.7.0:beta1
discoursediscourse
2.7.0:beta2
discoursediscourse
2.7.0:beta3
discoursediscourse
2.7.0:beta4
discoursediscourse
2.7.0:beta5
discoursediscourse
2.7.0:beta6
discoursediscourse
2.7.0:beta7
discoursediscourse
2.7.0:beta8
discoursediscourse
2.7.0:beta9
discoursediscourse
2.8.0:beta1
discoursediscourse
2.8.0:beta10
discoursediscourse
2.8.0:beta11
discoursediscourse
2.8.0:beta2
discoursediscourse
2.8.0:beta3
discoursediscourse
2.8.0:beta4
discoursediscourse
2.8.0:beta5
discoursediscourse
2.8.0:beta6
discoursediscourse
2.8.0:beta7
discoursediscourse
2.8.0:beta8
discoursediscourse
2.8.0:beta9
discoursediscourse
2.9.0:beta1
discoursediscourse
2.9.0:beta10
discoursediscourse
2.9.0:beta11
discoursediscourse
2.9.0:beta12
discoursediscourse
2.9.0:beta13
discoursediscourse
2.9.0:beta14
discoursediscourse
2.9.0:beta2
discoursediscourse
2.9.0:beta3
discoursediscourse
2.9.0:beta4
discoursediscourse
2.9.0:beta5
discoursediscourse
2.9.0:beta6
discoursediscourse
2.9.0:beta7
discoursediscourse
2.9.0:beta8
discoursediscourse
2.9.0:beta9
discoursediscourse
3.0.0:beta15
discoursediscourse
3.0.0:beta16
discoursediscourse
3.1.0:beta1
discoursediscourse
3.1.0:beta2
discoursediscourse
3.1.0:beta3
discoursediscourse
3.1.0:beta5
discoursediscourse
3.1.0:beta6
discoursediscourse
3.1.0:beta7
discoursediscourse
3.1.0:beta8
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/discourse/discourse/security/advisories/GHSA-2fq5-x3mm-v254
https://github.com/discourse/discourse/security/advisories/GHSA-2fq5-x3mm-v254