CVE-2023-44388: Malicious requests can fill up the log files resulting in a deinal of service in Discourse
Discourse is an open source platform for community discussion. A malicious request can cause production log files to quickly fill up and thus result in the server running out of disk space. This problem has been patched in the 3.1.1 stable and 3.2.0.beta2 versions of Discourse. It is possible to temporarily work around this problem by reducing the clientmaxbodysize nginx directive. clientmaxbodysize will limit the size of uploads that can be uploaded directly to the server.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-44388.
What is the severity rating for CVE-2023-44388?
The severity rating for CVE-2023-44388 is high, with a value of 7.5.
Which software versions are affected by CVE-2023-44388?
The Discourse versions 3.1.1 (stable) and 3.2.0-beta1 are affected by CVE-2023-44388.
How can I fix CVE-2023-44388?
CVE-2023-44388 can be fixed by updating to the patched versions of Discourse, namely 3.1.1 (stable) or 3.2.0.beta2.
Where can I find more information about CVE-2023-44388?
You can find more information about CVE-2023-44388 in the provided references: http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size and https://github.com/discourse/discourse/security/advisories/GHSA-89h3-g746-xmwq.