CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2023-22739 – Discourse subject to Allocation of Resources Without Limits or Throttling
https://notcve.org/view.php?id=CVE-2023-22739
Discourse is an open source platform for community discussion. Versions prior to 3.0.1 (stable), 3.1.0.beta2 (beta), and 3.1.0.beta2 (tests-passed) are subject to Allocation of Resources Without Limits or Throttling. As there is no limit on data contained in a draft, a malicious user can create an arbitrarily large draft, forcing the instance to a crawl. This issue is patched in versions 3.0.1 (stable), 3.1.0.beta2 (beta), and 3.1.0.beta2 (tests-passed). There are no workarounds. • https://github.com/discourse/discourse/security/advisories/GHSA-rqgr-g6v7-jcfc • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 8.8EPSS: 0%CPEs: 16EXPL: 0CVE-2023-22468 – Discourse vulnerable to Cross-site Scripting in local oneboxes
https://notcve.org/view.php?id=CVE-2023-22468
Discourse is an open source platform for community discussion. Versions prior to 2.8.13 (stable), 3.0.0.beta16 (beta) and 3.0.0beta16 (tests-passed), are vulnerable to cross-site Scripting. A maliciously crafted URL can be included in a post to carry out cross-site scripting attacks on sites with disabled or overly permissive CSP (Content Security Policy). Discourse's default CSP prevents this vulnerability. This vulnerability is patched in versions 2.8.13 (stable), 3.0.0.beta16 (beta) and 3.0.0beta16 (tests-passed). • https://github.com/discourse/discourse/security/advisories/GHSA-8mr2-xf8r-wr8m • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 0%CPEs: 206EXPL: 0CVE-2023-22455 – Discourse vulnerable to Cross-site Scripting through tag descriptions
https://notcve.org/view.php?id=CVE-2023-22455
Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 3.0.0.beta16 on the `beta` and `tests-passed` branches, tag descriptions, which can be updated by moderators, can be used for cross-site scripting attacks. This vulnerability can lead to a full XSS on sites which have modified or disabled Discourse’s default Content Security Policy. Versions 2.8.14 and 3.0.0.beta16 contain a patch. • https://github.com/discourse/discourse/commit/692329896ac64d8581947e977202c243eef3b5a2 https://github.com/discourse/discourse/security/advisories/GHSA-5rq6-466r-6mr9 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.0EPSS: 0%CPEs: 206EXPL: 0CVE-2023-22454 – Discourse vulnerable to Cross-site Scripting through pending post titles descriptions
https://notcve.org/view.php?id=CVE-2023-22454
Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 3.0.0.beta16 on the `beta` and `tests-passed` branches, pending post titles can be used for cross-site scripting attacks. Pending posts can be created by unprivileged users when a category has the "require moderator approval of all new topics" setting set. This vulnerability can lead to a full XSS on sites which have modified or disabled Discourse’s default Content Security Policy. A patch is available in versions 2.8.14 and 3.0.0.beta16. • https://github.com/discourse/discourse/commit/c0e2d7badac276d82a4056a994b48d68a8993a12 https://github.com/discourse/discourse/security/advisories/GHSA-ggq4-4qxc-c462 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 206EXPL: 0CVE-2023-22453 – Discourse vulnerable to exposure of user post counts per topic to unauthorized users
https://notcve.org/view.php?id=CVE-2023-22453
Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 3.0.0.beta16 on the `beta` and `tests-passed` branches, the number of times a user posted in an arbitrary topic is exposed to unauthorized users through the `/u/username.json` endpoint. The issue is patched in version 2.8.14 and 3.0.0.beta16. There is no known workaround. • https://github.com/discourse/discourse/commit/cbcf8a064b4889a19c991641e09c399bfa1ef2ad https://github.com/discourse/discourse/security/advisories/GHSA-xx97-6494-p2rv • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •