CVE-2023-38498

CVSS V2 None CVSS V3 None
Description
Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, a malicious user can prevent the defer queue from proceeding promptly on sites hosted in the same multisite installation. The issue is patched in version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches. There are no known workarounds for this vulnerability. Users of multisite configurations should upgrade.
Overview
  • CVE ID
  • CVE-2023-38498
  • Assigner
  • GitHub_M
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2023-07-28T15:18:18.903Z
  • Last Modified Date
  • 2023-07-28T15:18:18.903Z
Weakness Enumerations
CWE URL
CWE-400 http://cwe.mitre.org/data/definitions/400.html
CWE-770 http://cwe.mitre.org/data/definitions/770.html
References
Reference URL Reference Tags
https://github.com/discourse/discourse/security/advisories/GHSA-wv29-rm3f-4g2j x_refsource_CONFIRM
https://github.com/discourse/discourse/commit/26e267478d785e2f32ee7da4613e2cf4a65ff182 x_refsource_MISC
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2023-38498
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38498
History
Created Old Value New Value Data Type Notes
2024-06-25 21:23:49 Added to TrackCVE