CVE-2022-23549

CVSS V2 None CVSS V3 None
Description
Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 2.9.0.beta16 on the `beta` and `tests-passed` branches, users can create posts with raw body longer than the `max_length` site setting by including html comments that are not counted toward the character limit. This issue is patched in versions 2.8.14 and 2.9.0.beta16. There are no known workarounds.
Overview
  • CVE ID
  • CVE-2022-23549
  • Assigner
  • security-advisories@github.com
  • Vulnerability Status
  • Analyzed
  • Published Version
  • 2023-01-05T19:15:09
  • Last Modified Date
  • 2023-01-12T20:33:47
Weakness Enumerations
CWE URL
NVD-CWE-Other http://cwe.mitre.org/data/definitions/NVD-Other.html
CWE-20 http://cwe.mitre.org/data/definitions/20.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:* 1 OR 2.8.14
cpe:2.3:a:discourse:discourse:2.9.0:beta1:*:*:*:*:*:* 1 OR
cpe:2.3:a:discourse:discourse:2.9.0:beta10:*:*:*:*:*:* 1 OR
cpe:2.3:a:discourse:discourse:2.9.0:beta11:*:*:*:*:*:* 1 OR
cpe:2.3:a:discourse:discourse:2.9.0:beta12:*:*:*:*:*:* 1 OR
cpe:2.3:a:discourse:discourse:2.9.0:beta13:*:*:*:*:*:* 1 OR
cpe:2.3:a:discourse:discourse:2.9.0:beta14:*:*:*:*:*:* 1 OR
cpe:2.3:a:discourse:discourse:2.9.0:beta2:*:*:*:*:*:* 1 OR
cpe:2.3:a:discourse:discourse:2.9.0:beta3:*:*:*:*:*:* 1 OR
cpe:2.3:a:discourse:discourse:2.9.0:beta4:*:*:*:*:*:* 1 OR
cpe:2.3:a:discourse:discourse:2.9.0:beta5:*:*:*:*:*:* 1 OR
cpe:2.3:a:discourse:discourse:2.9.0:beta6:*:*:*:*:*:* 1 OR
cpe:2.3:a:discourse:discourse:2.9.0:beta7:*:*:*:*:*:* 1 OR
cpe:2.3:a:discourse:discourse:2.9.0:beta8:*:*:*:*:*:* 1 OR
cpe:2.3:a:discourse:discourse:3.0.0:beta15:*:*:*:*:*:* 1 OR
References
Reference URL Reference Tags
https://github.com/discourse/discourse/commit/bf6b08670a927cc80bb090b7a2e710b4b554e6a8
https://github.com/discourse/discourse/security/advisories/GHSA-p47g-v5wr-p4xp
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2022-23549
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23549
History
Created Old Value New Value Data Type Notes
2023-01-05 19:15:59 Added to TrackCVE
2023-01-05 19:15:59 Weakness Enumeration new
2023-01-05 21:16:41 2023-01-05T21:15:08 CVE Modified Date updated
2023-01-05 21:16:41 Received Awaiting Analysis Vulnerability Status updated
2023-01-05 21:16:43 Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 2.9.0.beta15 on the `beta` and `tests-passed` branches, users can create posts with raw body longer than the `max_length` site setting by including html comments that are not counted toward the character limit. This issue is patched in versions 2.8.14 and 2.9.0.beta16. There are no known workarounds. Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 2.9.0.beta16 on the `beta` and `tests-passed` branches, users can create posts with raw body longer than the `max_length` site setting by including html comments that are not counted toward the character limit. This issue is patched in versions 2.8.14 and 2.9.0.beta16. There are no known workarounds. Description updated
2023-01-10 17:18:11 Awaiting Analysis Undergoing Analysis Vulnerability Status updated
2023-01-12 21:14:51 2023-01-12T20:33:47 CVE Modified Date updated
2023-01-12 21:14:51 Undergoing Analysis Analyzed Vulnerability Status updated
2023-01-12 21:14:54 Weakness Enumeration update
2023-01-12 21:14:55 CPE Information updated