CVE-2023-37906
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
Discourse is an open source discussion platform, where prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, a malicious user can edit a post in a topic and cause a DoS with a carefully crafted edit reason.
Risk Assessment
The organization may be vulnerable to DoS attacks, which could lead to the unavailability of the discussion platform and disrupt communication.
Recommendation
It is recommended to upgrade to version 3.0.6 of the `stable` branch or 3.1.0.beta7 of the `beta` and `tests-passed` branches to mitigate this vulnerability.
Original NVD description (English source)
Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, a malicious user can edit a post in a topic and cause a DoS with a carefully crafted edit reason. The issue is patched in version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches. There are no known workarounds for this vulnerability.