CVE-2023-44388: Malicious requests can fill up the log files resulting in a deinal of service in Discourse
First published: Mon Oct 16 2023(Updated: )
Discourse is an open source platform for community discussion. A malicious request can cause production log files to quickly fill up and thus result in the server running out of disk space. This problem has been patched in the 3.1.1 stable and 3.2.0.beta2 versions of Discourse. It is possible to temporarily work around this problem by reducing the `client_max_body_size nginx directive`. `client_max_body_size` will limit the size of uploads that can be uploaded directly to the server.
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Discourse Discourse | <=3.1.1 | |
| Discourse Discourse | =3.2.0-beta1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-44388.
What is the severity rating for CVE-2023-44388?
The severity rating for CVE-2023-44388 is high, with a value of 7.5.
Which software versions are affected by CVE-2023-44388?
The Discourse versions 3.1.1 (stable) and 3.2.0-beta1 are affected by CVE-2023-44388.
How can I fix CVE-2023-44388?
CVE-2023-44388 can be fixed by updating to the patched versions of Discourse, namely 3.1.1 (stable) or 3.2.0.beta2.
Where can I find more information about CVE-2023-44388?
You can find more information about CVE-2023-44388 in the provided references: http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size and https://github.com/discourse/discourse/security/advisories/GHSA-89h3-g746-xmwq.
- collector/nvd-api
- collector/nvd-index
- agent/references
- agent/author
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/title
- agent/weakness
- agent/description
- agent/tags
- agent/event
- agent/first-publish-date
- vendor/discourse
- canonical/discourse discourse
- version/discourse discourse/3.1.1
- version/discourse discourse/3.2.0-beta1