CVE-2023-28440

LowCVSS 2.7/10Last modified Jun 17, 2026

Description

Discourse is an open source platform for community discussion. In affected versions a maliciously crafted request from a Discourse administrator can lead to a long-running request and eventual timeout. This has the greatest potential impact in shared hosting environments where admins are untrusted. This issue has been addressed in versions 3.0.3 and 3.1.0.beta4. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 2.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published: Apr 18, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-284417.5smartCARS 3 is flight tracking software. In version 0.5.8 and prior, all persons who have failed login attempts will have their password sto CVE-2023-284425.3GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. Prior to versions 2.20.CVE-2023-284435.5Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.23.3, the `directus_refresh_token` is no CVE-2023-284447.5angular-server-side-configuration helps configure an angular application at runtime on the server or in a docker container via environment v CVE-2023-284459.8Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Resizable ArrayBuffers passed to asynchronous functions t CVE-2023-284468.8Deno is a simple, modern and secure runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Arbitrary program names without CVE-2023-284476.1Smarty is a template engine for PHP. In affected versions smarty did not properly escape javascript code. An attacker could exploit this vul CVE-2023-284487.5Versionize is a framework for version tolerant serializion/deserialization of Rust data structures, designed for usecases that need fast des CVE-2023-28458.1Improper Access Control in GitHub repository cloudexplorer-dev/cloudexplorer-lite prior to v1.1.0.CVE-2023-284507.5An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 because of DNS CVE-2023-284517.5An issue was discovered in Technitium 11.0.2. There is a vulnerability (called BadDNS) in DNS resolving software, which triggers a resolver CVE-2023-284527.5An issue was discovered in CoreDNS through 1.10.1. There is a vulnerability in DNS resolving software, which triggers a resolver to ignore v