CVE-2023-38498
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
Discourse is an open source discussion platform, where prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, a malicious user can delay the defer queue processing on sites hosted in the same multisite installation.
Risk Assessment
This vulnerability may lead to reduced performance and availability of services on sites using multisite configurations, negatively impacting user experience.
Recommendation
It is recommended to upgrade to version 3.0.6 of the `stable` branch or 3.1.0.beta7 of the `beta` and `tests-passed` branches to mitigate this vulnerability.
Original NVD description (English source)
Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, a malicious user can prevent the defer queue from proceeding promptly on sites hosted in the same multisite installation. The issue is patched in version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches. There are no known workarounds for this vulnerability. Users of multisite configurations should upgrade.