CVE-2022-39226: Discourse user profile location and website fields were not sufficiently length-limited
Discourse is an open source discussion platform. In versions prior to 2.8.9 on the stable branch and prior to 2.9.0.beta10 on the beta and tests-passed branches, a malicious actor can add large payloads of text into the Location and Website fields of a user profile, which causes issues for other users when loading that profile. A fix to limit the length of user input for these fields is included in version 2.8.9 on the stable branch and version 2.9.0.beta10 on the beta and tests-passed branches. There are no known workarounds.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2022-39226?
CVE-2022-39226 is considered a moderate severity vulnerability due to the potential for user profile manipulation.
How does CVE-2022-39226 affect Discourse?
CVE-2022-39226 allows a malicious actor to inject large payloads into user profile fields, which can disrupt the normal functionality of Discourse.
How do I fix CVE-2022-39226?
To mitigate CVE-2022-39226, update your Discourse installation to version 2.8.9 or higher on the stable branch, or version 2.9.0.beta10 or higher on the beta and tests-passed branches.
Which versions of Discourse are affected by CVE-2022-39226?
CVE-2022-39226 affects Discourse versions prior to 2.8.9 on the stable branch and all beta versions below 2.9.0.beta10.
Who should be concerned about CVE-2022-39226?
Discourse administrators running affected versions should be concerned and take immediate steps to upgrade their systems to secure their users' profiles.