CVE-2022-23549

Published: Jan 5, 2023Modified: Nov 21, 2024

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 2.9.0.beta16 on the `beta` and `tests-passed` branches, users can create posts with raw body longer than the `max_length` site setting by including html comments that are not counted toward the character limit. This issue is patched in versions 2.8.14 and 2.9.0.beta16. There are no known workarounds.

Affected (15)

Products: Discourse: Discourse

Discourse

1 product

Discourse

Configuration A

15 vulnerable

Vulnerable Software	Affected Versions
Discourse Discourse	Before 2.8.14
Discourse Discourse	Version 2.9.0 beta10
Discourse Discourse	Version 2.9.0 beta11
Discourse Discourse	Version 2.9.0 beta12
Discourse Discourse	Version 2.9.0 beta13
Discourse Discourse	Version 2.9.0 beta14
Discourse Discourse	Version 2.9.0 beta1
Discourse Discourse	Version 2.9.0 beta2
Discourse Discourse	Version 2.9.0 beta3
Discourse Discourse	Version 2.9.0 beta4
Discourse Discourse	Version 2.9.0 beta5
Discourse Discourse	Version 2.9.0 beta6
Discourse Discourse	Version 2.9.0 beta7
Discourse Discourse	Version 2.9.0 beta8
Discourse Discourse	Version 3.0.0 beta15