Discourse Platform Patches Potential Availability Reduction Vulnerability
CVE-2024-43789

4.3MEDIUM

Key Information:

Vendor
Discourse
Status
Discourse
Vendor
CVE Published:
7 October 2024

Badges

👾 Exploit Exists📰 News Worthy

Summary

Discourse is an open source platform for community discussion. A user can create a post with many replies, and then attempt to fetch them all at once. This can potentially reduce the availability of a Discourse instance. This problem has been patched in the latest version of Discourse. All users area are advised to upgrade. There are no known workarounds for this vulnerability.

Affected Version(s)

discourse stable: < 3.3.1 < stable: 3.3.1

discourse beta: < 3.4.0.beta1 < beta: 3.4.0.beta1

News Articles

favicon imageNational Institute of Standards and Technology (.gov)

NVD - Home

CVE-2024-43789 - Discourse is an open source platform for community discussion. A user can create a post with many replies, and then attempt to fetch them all at once. This can potentially reduce the...

3 months ago

References

https://github.com/discourse/discourse/security/advisorie...
x_refsource_CONFIRM

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • 📰

    First article discovered by National Institute of Standards and Technology (.gov)

  • Vulnerability published

.