Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cveGitHub_MCVE-2023-38498
HistoryJul 28, 2023 - 4:15 p.m.

CVE-2023-38498

2023-07-2816:15:12
CWE-770
CWE-400
GitHub_M
web.nvd.nist.gov
34
cve-2023-38498
discourse
open source
discussion platform
vulnerability
upgrade
multisite configuration

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

31.7%

JSON

Discourse is an open source discussion platform. Prior to version 3.0.6 of the stable branch and version 3.1.0.beta7 of the beta and tests-passed branches, a malicious user can prevent the defer queue from proceeding promptly on sites hosted in the same multisite installation. The issue is patched in version 3.0.6 of the stable branch and version 3.1.0.beta7 of the beta and tests-passed branches. There are no known workarounds for this vulnerability. Users of multisite configurations should upgrade.

Affected configurations

Nvd
Vulners
Node
discoursediscourseRange<3.0.6stable
OR
discoursediscourseMatch1.1.0beta1beta
OR
discoursediscourseMatch1.1.0beta2beta
OR
discoursediscourseMatch1.1.0beta3beta
OR
discoursediscourseMatch1.1.0beta4beta
OR
discoursediscourseMatch1.1.0beta5beta
OR
discoursediscourseMatch1.1.0beta6beta
OR
discoursediscourseMatch1.1.0beta6bbeta
OR
discoursediscourseMatch1.1.0beta7beta
OR
discoursediscourseMatch1.1.0beta8beta
OR
discoursediscourseMatch1.2.0beta1beta
OR
discoursediscourseMatch1.2.0beta2beta
OR
discoursediscourseMatch1.2.0beta3beta
OR
discoursediscourseMatch1.2.0beta4beta
OR
discoursediscourseMatch1.2.0beta5beta
OR
discoursediscourseMatch1.2.0beta6beta
OR
discoursediscourseMatch1.2.0beta7beta
OR
discoursediscourseMatch1.2.0beta8beta
OR
discoursediscourseMatch1.2.0beta9beta
OR
discoursediscourseMatch1.3.0beta1beta
OR
discoursediscourseMatch1.3.0beta10beta
OR
discoursediscourseMatch1.3.0beta11beta
OR
discoursediscourseMatch1.3.0beta2beta
OR
discoursediscourseMatch1.3.0beta3beta
OR
discoursediscourseMatch1.3.0beta4beta
OR
discoursediscourseMatch1.3.0beta5beta
OR
discoursediscourseMatch1.3.0beta6beta
OR
discoursediscourseMatch1.3.0beta7beta
OR
discoursediscourseMatch1.3.0beta8beta
OR
discoursediscourseMatch1.3.0beta9beta
OR
discoursediscourseMatch1.4.0beta1beta
OR
discoursediscourseMatch1.4.0beta10beta
OR
discoursediscourseMatch1.4.0beta11beta
OR
discoursediscourseMatch1.4.0beta12beta
OR
discoursediscourseMatch1.4.0beta2beta
OR
discoursediscourseMatch1.4.0beta3beta
OR
discoursediscourseMatch1.4.0beta4beta
OR
discoursediscourseMatch1.4.0beta5beta
OR
discoursediscourseMatch1.4.0beta6beta
OR
discoursediscourseMatch1.4.0beta7beta
OR
discoursediscourseMatch1.4.0beta8beta
OR
discoursediscourseMatch1.4.0beta9beta
OR
discoursediscourseMatch1.5.0beta1beta
OR
discoursediscourseMatch1.5.0beta10beta
OR
discoursediscourseMatch1.5.0beta11beta
OR
discoursediscourseMatch1.5.0beta12beta
OR
discoursediscourseMatch1.5.0beta13beta
OR
discoursediscourseMatch1.5.0beta13bbeta
OR
discoursediscourseMatch1.5.0beta14beta
OR
discoursediscourseMatch1.5.0beta2beta
OR
discoursediscourseMatch1.5.0beta3beta
OR
discoursediscourseMatch1.5.0beta4beta
OR
discoursediscourseMatch1.5.0beta5beta
OR
discoursediscourseMatch1.5.0beta6beta
OR
discoursediscourseMatch1.5.0beta7beta
OR
discoursediscourseMatch1.5.0beta8beta
OR
discoursediscourseMatch1.5.0beta9beta
OR
discoursediscourseMatch1.6.0beta1beta
OR
discoursediscourseMatch1.6.0beta10beta
OR
discoursediscourseMatch1.6.0beta11beta
OR
discoursediscourseMatch1.6.0beta12beta
OR
discoursediscourseMatch1.6.0beta2beta
OR
discoursediscourseMatch1.6.0beta3beta
OR
discoursediscourseMatch1.6.0beta4beta
OR
discoursediscourseMatch1.6.0beta5beta
OR
discoursediscourseMatch1.6.0beta6beta
OR
discoursediscourseMatch1.6.0beta7beta
OR
discoursediscourseMatch1.6.0beta8beta
OR
discoursediscourseMatch1.6.0beta9beta
OR
discoursediscourseMatch1.7.0beta1beta
OR
discoursediscourseMatch1.7.0beta10beta
OR
discoursediscourseMatch1.7.0beta11beta
OR
discoursediscourseMatch1.7.0beta2beta
OR
discoursediscourseMatch1.7.0beta3beta
OR
discoursediscourseMatch1.7.0beta4beta
OR
discoursediscourseMatch1.7.0beta5beta
OR
discoursediscourseMatch1.7.0beta6beta
OR
discoursediscourseMatch1.7.0beta7beta
OR
discoursediscourseMatch1.7.0beta8beta
OR
discoursediscourseMatch1.7.0beta9beta
OR
discoursediscourseMatch1.8.0beta1beta
OR
discoursediscourseMatch1.8.0beta10beta
OR
discoursediscourseMatch1.8.0beta11beta
OR
discoursediscourseMatch1.8.0beta12beta
OR
discoursediscourseMatch1.8.0beta13beta
OR
discoursediscourseMatch1.8.0beta2beta
OR
discoursediscourseMatch1.8.0beta3beta
OR
discoursediscourseMatch1.8.0beta4beta
OR
discoursediscourseMatch1.8.0beta5beta
OR
discoursediscourseMatch1.8.0beta6beta
OR
discoursediscourseMatch1.8.0beta7beta
OR
discoursediscourseMatch1.8.0beta8beta
OR
discoursediscourseMatch1.8.0beta9beta
OR
discoursediscourseMatch1.9.0beta1beta
OR
discoursediscourseMatch1.9.0beta10beta
OR
discoursediscourseMatch1.9.0beta11beta
OR
discoursediscourseMatch1.9.0beta12beta
OR
discoursediscourseMatch1.9.0beta13beta
OR
discoursediscourseMatch1.9.0beta14beta
OR
discoursediscourseMatch1.9.0beta15beta
OR
discoursediscourseMatch1.9.0beta16beta
OR
discoursediscourseMatch1.9.0beta17beta
OR
discoursediscourseMatch1.9.0beta2beta
OR
discoursediscourseMatch1.9.0beta3beta
OR
discoursediscourseMatch1.9.0beta4beta
OR
discoursediscourseMatch1.9.0beta5beta
OR
discoursediscourseMatch1.9.0beta6beta
OR
discoursediscourseMatch1.9.0beta7beta
OR
discoursediscourseMatch1.9.0beta8beta
OR
discoursediscourseMatch1.9.0beta9beta
OR
discoursediscourseMatch2.0.0beta1beta
OR
discoursediscourseMatch2.0.0beta10beta
OR
discoursediscourseMatch2.0.0beta2beta
OR
discoursediscourseMatch2.0.0beta3beta
OR
discoursediscourseMatch2.0.0beta4beta
OR
discoursediscourseMatch2.0.0beta5beta
OR
discoursediscourseMatch2.0.0beta6beta
OR
discoursediscourseMatch2.0.0beta7beta
OR
discoursediscourseMatch2.0.0beta8beta
OR
discoursediscourseMatch2.0.0beta9beta
OR
discoursediscourseMatch2.1.0beta1beta
OR
discoursediscourseMatch2.1.0beta2beta
OR
discoursediscourseMatch2.1.0beta3beta
OR
discoursediscourseMatch2.1.0beta4beta
OR
discoursediscourseMatch2.1.0beta5beta
OR
discoursediscourseMatch2.1.0beta6beta
OR
discoursediscourseMatch2.2.0beta1beta
OR
discoursediscourseMatch2.2.0beta10beta
OR
discoursediscourseMatch2.2.0beta2beta
OR
discoursediscourseMatch2.2.0beta3beta
OR
discoursediscourseMatch2.2.0beta4beta
OR
discoursediscourseMatch2.2.0beta5beta
OR
discoursediscourseMatch2.2.0beta6beta
OR
discoursediscourseMatch2.2.0beta7beta
OR
discoursediscourseMatch2.2.0beta8beta
OR
discoursediscourseMatch2.2.0beta9beta
OR
discoursediscourseMatch2.3.0beta1beta
OR
discoursediscourseMatch2.3.0beta10beta
OR
discoursediscourseMatch2.3.0beta11beta
OR
discoursediscourseMatch2.3.0beta2beta
OR
discoursediscourseMatch2.3.0beta3beta
OR
discoursediscourseMatch2.3.0beta4beta
OR
discoursediscourseMatch2.3.0beta5beta
OR
discoursediscourseMatch2.3.0beta6beta
OR
discoursediscourseMatch2.3.0beta7beta
OR
discoursediscourseMatch2.3.0beta8beta
OR
discoursediscourseMatch2.3.0beta9beta
OR
discoursediscourseMatch2.4.0beta1beta
OR
discoursediscourseMatch2.4.0beta10beta
OR
discoursediscourseMatch2.4.0beta11beta
OR
discoursediscourseMatch2.4.0beta2beta
OR
discoursediscourseMatch2.4.0beta3beta
OR
discoursediscourseMatch2.4.0beta4beta
OR
discoursediscourseMatch2.4.0beta5beta
OR
discoursediscourseMatch2.4.0beta6beta
OR
discoursediscourseMatch2.4.0beta7beta
OR
discoursediscourseMatch2.4.0beta8beta
OR
discoursediscourseMatch2.4.0beta9beta
OR
discoursediscourseMatch2.5.0beta1beta
OR
discoursediscourseMatch2.5.0beta2beta
OR
discoursediscourseMatch2.5.0beta3beta
OR
discoursediscourseMatch2.5.0beta4beta
OR
discoursediscourseMatch2.5.0beta5beta
OR
discoursediscourseMatch2.5.0beta6beta
OR
discoursediscourseMatch2.5.0beta7beta
OR
discoursediscourseMatch2.6.0beta1beta
OR
discoursediscourseMatch2.6.0beta2beta
OR
discoursediscourseMatch2.6.0beta3beta
OR
discoursediscourseMatch2.6.0beta4beta
OR
discoursediscourseMatch2.6.0beta5beta
OR
discoursediscourseMatch2.6.0beta6beta
OR
discoursediscourseMatch2.7.0beta1beta
OR
discoursediscourseMatch2.7.0beta2beta
OR
discoursediscourseMatch2.7.0beta3beta
OR
discoursediscourseMatch2.7.0beta4beta
OR
discoursediscourseMatch2.7.0beta5beta
OR
discoursediscourseMatch2.7.0beta6beta
OR
discoursediscourseMatch2.7.0beta7beta
OR
discoursediscourseMatch2.7.0beta8beta
OR
discoursediscourseMatch2.7.0beta9beta
OR
discoursediscourseMatch2.8.0beta1beta
OR
discoursediscourseMatch2.8.0beta10beta
OR
discoursediscourseMatch2.8.0beta11beta
OR
discoursediscourseMatch2.8.0beta2beta
OR
discoursediscourseMatch2.8.0beta3beta
OR
discoursediscourseMatch2.8.0beta4beta
OR
discoursediscourseMatch2.8.0beta5beta
OR
discoursediscourseMatch2.8.0beta6beta
OR
discoursediscourseMatch2.8.0beta7beta
OR
discoursediscourseMatch2.8.0beta8beta
OR
discoursediscourseMatch2.8.0beta9beta
OR
discoursediscourseMatch2.9.0beta1beta
OR
discoursediscourseMatch2.9.0beta10beta
OR
discoursediscourseMatch2.9.0beta11beta
OR
discoursediscourseMatch2.9.0beta12beta
OR
discoursediscourseMatch2.9.0beta13beta
OR
discoursediscourseMatch2.9.0beta14beta
OR
discoursediscourseMatch2.9.0beta2beta
OR
discoursediscourseMatch2.9.0beta3beta
OR
discoursediscourseMatch2.9.0beta4beta
OR
discoursediscourseMatch2.9.0beta5beta
OR
discoursediscourseMatch2.9.0beta6beta
OR
discoursediscourseMatch2.9.0beta7beta
OR
discoursediscourseMatch2.9.0beta8beta
OR
discoursediscourseMatch2.9.0beta9beta
OR
discoursediscourseMatch3.0.0beta15beta
OR
discoursediscourseMatch3.0.0beta16beta
OR
discoursediscourseMatch3.1.0beta1beta
OR
discoursediscourseMatch3.1.0beta2beta
OR
discoursediscourseMatch3.1.0beta3beta
OR
discoursediscourseMatch3.1.0beta5beta
OR
discoursediscourseMatch3.1.0beta6beta
VendorProductVersionCPE
discoursediscourse*cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*
discoursediscourse1.1.0cpe:2.3:a:discourse:discourse:1.1.0:beta1:*:*:beta:*:*:*
discoursediscourse1.1.0cpe:2.3:a:discourse:discourse:1.1.0:beta2:*:*:beta:*:*:*
discoursediscourse1.1.0cpe:2.3:a:discourse:discourse:1.1.0:beta3:*:*:beta:*:*:*
discoursediscourse1.1.0cpe:2.3:a:discourse:discourse:1.1.0:beta4:*:*:beta:*:*:*
discoursediscourse1.1.0cpe:2.3:a:discourse:discourse:1.1.0:beta5:*:*:beta:*:*:*
discoursediscourse1.1.0cpe:2.3:a:discourse:discourse:1.1.0:beta6:*:*:beta:*:*:*
discoursediscourse1.1.0cpe:2.3:a:discourse:discourse:1.1.0:beta6b:*:*:beta:*:*:*
discoursediscourse1.1.0cpe:2.3:a:discourse:discourse:1.1.0:beta7:*:*:beta:*:*:*
discoursediscourse1.1.0cpe:2.3:a:discourse:discourse:1.1.0:beta8:*:*:beta:*:*:*
Rows per page:
1-10 of 2121

CNA Affected

[
  {
    "vendor": "discourse",
    "product": "discourse",
    "versions": [
      {
        "version": ">= 3.1.0.beta1, < 3.1.0.beta7",
        "status": "affected"
      },
      {
        "version": "< 3.0.6",
        "status": "affected"
      }
    ]
  }
]

Related

prion 1
cvelist 1
openvas 2
osv 2
nvd 1
githubexploit 2
prion
prion
Design/Logic Flaw
2023-07-28 16:15:00
cvelist
cvelist
CVE-2023-38498 Discourse vulnerable to DoS via defer queue
2023-07-28 15:18:18
openvas
openvas
Discourse < 3.0.7 DoS Vulnerability
2023-07-31 00:00:00
Discourse 3.1.x < 3.1.0.beta8 DoS Vulnerability
2023-07-31 00:00:00
osv
osv
BIT-discourse-2023-38498
2024-03-06 10:55:24
CVE-2023-38498
2023-07-28 16:15:12
nvd
nvd
CVE-2023-38498
2023-07-28 16:15:12
githubexploit
githubexploit
Exploit for Unquoted Search Path or Element in Openbsd Openssh
2023-08-09 19:56:07
Exploit for Allocation of Resources Without Limits or Throttling in Discourse
2023-08-09 19:56:07

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

31.7%

JSON
Related for CVE-2023-38498
prion1cvelist1openvas2osv2nvd1githubexploit2