CVE-2024-27100: Denial of service via Staff Actions in Discourse
First published: Fri Mar 15 2024(Updated: )
Discourse is an open source platform for community discussion. In affected versions the endpoints for suspending users, silencing users and exporting CSV files weren't enforcing limits on the sizes of the parameters that they accept. This could lead to excessive resource consumption which could render an instance inoperable. A site could be disrupted by either a malicious moderator on the same site or a malicious staff member on another site in the same multisite cluster. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Discourse | <latest stable<beta<tests-passed |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-27100?
CVE-2024-27100 is considered a moderate severity vulnerability due to its potential for excessive resource consumption.
How do I fix CVE-2024-27100?
To fix CVE-2024-27100, update your Discourse installation to the latest stable version or apply any available security patches.
What versions of Discourse are affected by CVE-2024-27100?
CVE-2024-27100 affects all versions of Discourse up to the latest stable release, including beta and tests-passed versions.
What is the impact of CVE-2024-27100 on Discourse?
The impact of CVE-2024-27100 includes the risk of resource exhaustion due to unregulated parameter sizes in specific endpoints.
Is there any exploit for CVE-2024-27100?
While there is no public exploit for CVE-2024-27100, the vulnerability poses a risk that could be exploited to disrupt normal operations.
- agent/references
- agent/title
- agent/weakness
- agent/type
- agent/description
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/author
- agent/severity
- agent/event
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/discourse
- canonical/discourse