CVE-2023-22739

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Discourse is an open source platform for community discussion. Versions prior to 3.0.1 (stable), 3.1.0.beta2 (beta), and 3.1.0.beta2 (tests-passed) are subject to Allocation of Resources Without Limits or Throttling. As there is no limit on data contained in a draft, a malicious user can create an arbitrarily large draft, forcing the instance to a crawl. This issue is patched in versions 3.0.1 (stable), 3.1.0.beta2 (beta), and 3.1.0.beta2 (tests-passed). There are no workarounds.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

No affected versions have been published.

Timeline

Published: Jan 26, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-227406.5Discourse is an open source platform for community discussion. Versions prior to 3.1.0.beta1 (beta) (tests-passed) are vulnerable to Alloca CVE-2023-227419.8Sofia-SIP is an open-source SIP User-Agent library, compliant with the IETF RFC3261 specification. In affected versions Sofia-SIP **lacks bo CVE-2023-227425.9libgit2 is a cross-platform, linkable library implementation of Git. When using an SSH remote with the optional libssh2 backend, libgit2 doe CVE-2023-227437.3Git for Windows is the Windows port of the revision control system Git. Prior to Git for Windows version 2.39.2, by carefully crafting DLL a CVE-2023-227456.4tpm2-tss is an open source software implementation of the Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2 Software Stack (TSS2 CVE-2023-227467.5CKAN is an open-source DMS (data management system) for powering data hubs and data portals. When creating a new container based on one of t CVE-2023-227479.8There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted p CVE-2023-227489.8There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted p CVE-2023-227499.8There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted p CVE-2023-22755.4The WooCommerce Multivendor Marketplace – REST API plugin for WordPress is vulnerable to unauthorized access of data and addition of data du CVE-2023-227509.8There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted p CVE-2023-227519.8There are stack-based buffer overflow vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted