CVE-2023-30606
CVSS V2 None
CVSS V3 None
Description
Discourse is an open source platform for community discussion. In affected versions a user logged as an administrator can call arbitrary methods on the `SiteSetting` class, notably `#clear_cache!` and `#notify_changed!`, which when done on a multisite instance, can affect the entire cluster resulting in a denial of service. Users not running in multisite environments are not affected. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Overview
- CVE ID
- CVE-2023-30606
- Assigner
- security-advisories@github.com
- Vulnerability Status
- Undergoing Analysis
- Published Version
- 2023-04-18T22:15:08
- Last Modified Date
- 2023-04-19T12:39:47
Weakness Enumerations
References
| Reference URL | Reference Tags |
|---|---|
| https://github.com/discourse/discourse/security/advisories/GHSA-jj93-w3mv-3jvv |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2023-30606 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-30606 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2023-04-19 00:01:21 | Added to TrackCVE | |||
| 2023-04-19 00:01:22 | Weakness Enumeration | new | ||
| 2023-04-19 13:00:40 | 2023-04-19T12:39:47 | CVE Modified Date | updated | |
| 2023-04-19 13:00:40 | Received | Awaiting Analysis | Vulnerability Status | updated |
| 2023-04-25 17:01:10 | Awaiting Analysis | Undergoing Analysis | Vulnerability Status | updated |