deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-25592
Published: 2024-03-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Broken Link Checker allows Stored XSS.This issue affects Broken Link Checker: from n/a through 2.2.3.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/broken-link-checker/wordpress-broken-link-checker-plugin-2-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/broken-link-checker/wordpress-broken-link-checker-plugin-2-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-25593
Published: 2024-03-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms – Ultimate Form Builder allows Stored XSS.This issue affects NEX-Forms – Ultimate Form Builder: from n/a through 8.5.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/nex-forms-express-wp-form-builder/wordpress-nex-forms-plugin-8-5-5-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/nex-forms-express-wp-form-builder/wordpress-nex-forms-plugin-8-5-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-25596
Published: 2024-03-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Doofinder Doofinder for WooCommerce allows Stored XSS.This issue affects Doofinder for WooCommerce: from n/a through 2.1.8.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/doofinder-for-woocommerce/wordpress-doofinder-for-woocommerce-plugin-2-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/doofinder-for-woocommerce/wordpress-doofinder-for-woocommerce-plugin-2-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-25597
Published: 2024-03-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Etoile Web Design Ultimate Reviews allows Stored XSS.This issue affects Ultimate Reviews: from n/a through 3.2.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/ultimate-reviews/wordpress-ultimate-reviews-plugin-3-2-8-unauthenticated-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ultimate-reviews/wordpress-ultimate-reviews-plugin-3-2-8-unauthenticated-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-46179
Published: 2024-03-15
Description: IBM Sterling Secure Proxy 6.0.3 and 6.1.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.  IBM X-Force ID:  269683.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-614
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/269683; https://www.ibm.com/support/pages/node/7142038; https://exchange.xforce.ibmcloud.com/vulnerabilities/269683
CVE: CVE-2023-46182
Published: 2024-03-15
Description: IBM Sterling Secure Proxy 6.0.3 and 6.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  269692.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/269692; https://www.ibm.com/support/pages/node/7142038; https://exchange.xforce.ibmcloud.com/vulnerabilities/269692
CVE: CVE-2023-47162
Published: 2024-03-15
Description: IBM Sterling Secure Proxy 6.0.3 and 6.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  270973.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/270973; https://www.ibm.com/support/pages/node/7142038; https://exchange.xforce.ibmcloud.com/vulnerabilities/270973
CVE: CVE-2023-50886
Published: 2024-03-15
Description: Cross-Site Request Forgery (CSRF), Incorrect Authorization vulnerability in wpWax Legal Pages.This issue affects Legal Pages: from n/a through 1.3.7.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-863
References: https://patchstack.com/database/vulnerability/legal-pages/wordpress-legal-pages-plugin-1-3-7-broken-access-control-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/legal-pages/wordpress-legal-pages-plugin-1-3-7-broken-access-control-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-50898
Published: 2024-03-15
Description: Missing Authorization vulnerability in sirv.Com Sirv.This issue affects Sirv: from n/a through 7.1.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/sirv/wordpress-image-optimizer-resizer-and-cdn-sirv-plugin-7-1-2-broken-access-control-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/sirv/wordpress-image-optimizer-resizer-and-cdn-sirv-plugin-7-1-2-broken-access-control-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-51369
Published: 2024-03-15
Description: Cross-Site Request Forgery (CSRF) vulnerability in SysBasics Customize My Account for WooCommerce.This issue affects Customize My Account for WooCommerce: from n/a through 1.8.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/customize-my-account-for-woocommerce/wordpress-customize-my-account-for-woocommerce-plugin-1-8-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/customize-my-account-for-woocommerce/wordpress-customize-my-account-for-woocommerce-plugin-1-8-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-51522
Published: 2024-03-15
Description: Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs Paid Member Subscriptions.This issue affects Paid Member Subscriptions: from n/a through 2.10.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/paid-member-subscriptions/wordpress-paid-membership-subscriptions-plugin-2-10-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/paid-member-subscriptions/wordpress-paid-membership-subscriptions-plugin-2-10-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-28318
Published: 2024-03-15
Description: gpac 2.3-DEV-rev921-g422b78ecf-master was discovered to contain a out of boundary write vulnerability via swf_get_string at scene_manager/swf_parse.c:325
CVSS Score: 7.1 (HIGH)
CWE: CWE-787
References: https://github.com/gpac/gpac/issues/2764; https://github.com/gpac/gpac/issues/2764
CVE: CVE-2024-28319
Published: 2024-03-15
Description: gpac 2.3-DEV-rev921-g422b78ecf-master was discovered to contain an out of boundary read vulnerability via gf_dash_setup_period media_tools/dash_client.c:6374
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-125
References: https://github.com/gpac/gpac/issues/2763; https://github.com/gpac/gpac/issues/2763
CVE: CVE-2021-38938
Published: 2024-03-15
Description: IBM Host Access Transformation Services (HATS) 9.6 through 9.6.1.4 and 9.7 through 9.7.0.3 stores user credentials in plain clear text which can be read by a local user.  IBM X-Force ID:  210989.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-522
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/210989; https://www.ibm.com/support/pages/node/6832964; https://exchange.xforce.ibmcloud.com/vulnerabilities/210989
CVE: CVE-2023-46181
Published: 2024-03-15
Description: IBM Sterling Secure Proxy 6.0.3 and 6.1.0 allows web pages to be stored locally which can be read by another user on the system.  IBM X-Force ID:  269686.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-525
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/269686; https://www.ibm.com/support/pages/node/7142038; https://exchange.xforce.ibmcloud.com/vulnerabilities/269686
CVE: CVE-2023-47147
Published: 2024-03-15
Description: IBM Sterling Secure Proxy 6.0.3 and 6.1.0 could allow an attacker to overwrite a log message under specific conditions.  IBM X-Force ID:  270598.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-73
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/270598; https://www.ibm.com/support/pages/node/7142038; https://exchange.xforce.ibmcloud.com/vulnerabilities/270598
CVE: CVE-2023-47699
Published: 2024-03-15
Description: IBM Sterling Secure Proxy 6.0.3 and 6.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  270974.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/270974; https://www.ibm.com/support/pages/node/7142038; https://exchange.xforce.ibmcloud.com/vulnerabilities/270974
CVE: CVE-2024-28403
Published: 2024-03-15
Description: TOTOLINK X2000R before V1.0.0-B20[PII_REDACTED] is vulnerable to Cross Site Scripting (XSS) via the VPN Page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/4hsien/CVE-vulns/blob/main/TOTOLINK/X2000R/XSS_5_VPN/XSS.md; https://www.totolink.net/home/menu/detail/menu_listtpl/products/id/242/ids/33.html; https://github.com/4hsien/CVE-vulns/blob/main/TOTOLINK/X2000R/XSS_5_VPN/XSS.md
CVE: CVE-2023-6960
Published: 2024-03-15
Description: TTLock App virtual keys and settings are only deleted client side, and if preserved, can access the lock after intended deletion.
CVSS Score: 7.5 (HIGH)
References: https://alephsecurity.com/2024/03/07/kontrol-lux-lock-2/; https://alephsecurity.com/2024/03/07/kontrol-lux-lock-2/; https://www.kb.cert.org/vuls/id/949046
CVE: CVE-2023-7003
Published: 2024-03-15
Description: The AES key utilized in the pairing process between a lock using Sciener firmware and a wireless keypad is not unique, and can be reused to compromise other locks using the Sciener firmware.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-323
References: https://alephsecurity.com/2024/03/07/kontrol-lux-lock-2/; https://alephsecurity.com/2024/03/07/kontrol-lux-lock-2/; https://www.kb.cert.org/vuls/id/949046
CVE: CVE-2023-7004
Published: 2024-03-15
Description: The TTLock App does not employ proper verification procedures to ensure that it is communicating with the expected device, allowing for connection to a device that spoofs the MAC address of a lock, which compromises the legitimate locks integrity.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-940
References: https://alephsecurity.com/2024/03/07/kontrol-lux-lock-2/; https://alephsecurity.com/2024/03/07/kontrol-lux-lock-2/; https://www.kb.cert.org/vuls/id/949046
CVE: CVE-2023-7006
Published: 2024-03-15
Description: The unlockKey character in a lock using Sciener firmware can be brute forced through repeated challenge requests, compromising the locks integrity.
CVSS Score: 9.1 (CRITICAL)
References: https://alephsecurity.com/2024/03/07/kontrol-lux-lock-2/; https://alephsecurity.com/2024/03/07/kontrol-lux-lock-2/; https://www.kb.cert.org/vuls/id/949046
CVE: CVE-2023-7007
Published: 2024-03-15
Description: Sciener server does not validate connection requests from the GatewayG2, allowing an impersonation attack that provides the attacker the unlockKey field.
CVSS Score: 8.2 (HIGH)
References: https://alephsecurity.com/2024/03/07/kontrol-lux-lock-2/; https://alephsecurity.com/2024/03/07/kontrol-lux-lock-2/; https://www.kb.cert.org/vuls/id/949046
CVE: CVE-2023-7009
Published: 2024-03-15
Description: Some Sciener-based locks support plaintext message processing over Bluetooth Low Energy, allowing unencrypted malicious commands to be passed to the lock. These malicious commands, less then 16 bytes in length, will be processed by the lock as if they were encrypted communications. This can be further exploited by an attacker to compromise the lock's integrity.
CVSS Score: 8.2 (HIGH)
References: https://alephsecurity.com/2024/03/07/kontrol-lux-lock-2/; https://alephsecurity.com/2024/03/07/kontrol-lux-lock-2/; https://www.kb.cert.org/vuls/id/949046
CVE: CVE-2023-7017
Published: 2024-03-15
Description: Sciener locks' firmware update mechanism do not authenticate or validate firmware updates if passed to the lock through the Bluetooth Low Energy service. A challenge request can be sent to the lock with a command to prepare for an update, rather than an unlock request, allowing an attacker to compromise the device.
CVSS Score: 9.8 (CRITICAL)
References: https://alephsecurity.com/2024/03/07/kontrol-lux-lock-2/; https://alephsecurity.com/2024/03/07/kontrol-lux-lock-2/; https://www.kb.cert.org/vuls/id/949046
CVE: CVE-2024-28401
Published: 2024-03-15
Description: TOTOLINK X2000R before v1.0.0-B20[PII_REDACTED] contains a Store Cross-site scripting (XSS) vulnerability in Root Access Control under the Wireless Page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/4hsien/CVE-vulns/blob/main/TOTOLINK/X2000R/XSS_1_Root_Access_Control/XSS.md; https://www.totolink.net/home/menu/detail/menu_listtpl/products/id/242/ids/33.html; https://github.com/4hsien/CVE-vulns/blob/main/TOTOLINK/X2000R/XSS_1_Root_Access_Control/XSS.md
CVE: CVE-2024-28404
Published: 2024-03-15
Description: TOTOLINK X2000R before V1.0.0-B20[PII_REDACTED] contains a Stored Cross-site scripting (XSS) vulnerability in MAC Filtering under the Firewall Page.
CVSS Score: 8.0 (HIGH)
CWE: CWE-79
References: https://github.com/4hsien/CVE-vulns/blob/main/TOTOLINK/X2000R/XSS_3_MAC_Filtering/XSS.md; https://www.totolink.net/home/menu/detail/menu_listtpl/products/id/242/ids/33.html; https://github.com/4hsien/CVE-vulns/blob/main/TOTOLINK/X2000R/XSS_3_MAC_Filtering/XSS.md
CVE: CVE-2024-2497
Published: 2024-03-15
Description: A vulnerability was found in RaspAP raspap-webgui 3.0.9 and classified as critical. This issue affects some unknown processing of the file includes/provider.php of the component HTTP POST Request Handler. The manipulation of the argument country leads to code injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256919. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-94
References: https://toradah.notion.site/Code-Injection-Leading-to-Remote-Code-Execution-RCE-in-RaspAP-Web-GUI-d321e1a416694520bec7099253c65060?pvs=4; https://vuldb.com/?ctiid.256919; https://vuldb.com/?id.256919
CVE: CVE-2024-2193
Published: 2024-03-15
Description: A Speculative Race Condition (SRC) vulnerability that impacts modern CPU architectures supporting speculative execution (related to Spectre V1) has been disclosed. An unauthenticated attacker can exploit this vulnerability to disclose arbitrary data from the CPU using race conditions to access the speculative executable code paths.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-362
References: http://www.openwall.com/lists/oss-security/2024/03/12/14; https://download.vusec.net/papers/ghostrace_sec24.pdf; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/?id=944d5fe50f3f03daacfea16300e656a1691c4a23
CVE: CVE-2024-2537
Published: 2024-03-15
Description: Improper Control of Dynamically-Managed Code Resources vulnerability in Logitech Logi Tune on MacOS allows Local Code Inclusion.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-913, CWE-913
References: https://hackerone.com/reports/2376663; https://hackerone.com/reports/2376663
CVE: CVE-2023-51699
Published: 2024-03-15
Description: Fluid is an open source Kubernetes-native Distributed Dataset Orchestrator and Accelerator for data-intensive applications. An OS command injection vulnerability within the Fluid project's JuicefsRuntime can potentially allow an authenticated user, who has the authority to create or update the K8s CRD Dataset/JuicefsRuntime, to execute arbitrary OS commands within the juicefs related containers. This could lead to unauthorized access, modification or deletion of data. Users who're using versions < 0.9.3 with JuicefsRuntime should upgrade to v0.9.3.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-78, CWE-78
References: https://github.com/fluid-cloudnative/fluid/commit/e0184cff8790ad000c3e8943392c7f544fad7d66; https://github.com/fluid-cloudnative/fluid/security/advisories/GHSA-wx8q-4gm9-rj2g; https://github.com/fluid-cloudnative/fluid/commit/e0184cff8790ad000c3e8943392c7f544fad7d66
CVE: CVE-2023-7060
Published: 2024-03-15
Description: Zephyr OS IP packet handling does not properly drop IP packets arriving on an external interface with a source address equal to 127.0.01 or the destination address.
CVSS Score: 8.6 (HIGH)
CWE: CWE-20
References: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-fjc8-223c-qgqr; https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-fjc8-223c-qgqr
CVE: CVE-2024-28252
Published: 2024-03-15
Description: CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. If you have a NetFraming based CoreWCF service, extra system resources could be consumed by connections being left established instead of closing or aborting them. There are two scenarios when this can happen. When a client established a connection to the service and sends no data, the service will wait indefinitely for the client to initiate the NetFraming session handshake. Additionally, once a client has established a session, if the client doesn't send any requests for the period of time configured in the binding ReceiveTimeout, the connection is not properly closed as part of the session being aborted. The bindings affected by this behavior are NetTcpBinding, NetNamedPipeBinding, and UnixDomainSocketBinding. Only NetTcpBinding has the ability to accept non local connections. The currently supported versions of CoreWCF are v1.4.x and v1.5.x. The fix can be found in v1.4.2 and v1.5.2 of the CoreWCF packages. Users are advised to upgrade. There are no workarounds for this issue.

CVSS Score: 7.5 (HIGH)
CWE: CWE-404, CWE-404
References: https://github.com/CoreWCF/CoreWCF/issues/1345; https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-32jq-mv89-5rx7; https://github.com/CoreWCF/CoreWCF/issues/1345
CVE: CVE-2024-28851
Published: 2024-03-15
Description: The Snowflake Hive metastore connector provides an easy way to query Hive-managed data via Snowflake. Snowflake Hive MetaStore Connector has addressed a potential elevation of privilege vulnerability in a `helper script` for the Hive MetaStore Connector. A malicious insider without admin privileges could, in theory, use the script to download content from a Microsoft domain to the local system and replace the valid content with malicious code. If the attacker then also had local access to the same system where the maliciously modified script is run, they could attempt to manipulate users into executing the attacker-controlled helper script, potentially gaining elevated privileges to the local system. The vulnerability in the script was patched on February 09, 2024, without a version bump to the Connector. User who use the helper script are strongly advised to use the latest version as soon as possible. Users unable to upgrade should avoid using the helper script.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-269
References: https://github.com/snowflakedb/snowflake-hive-metastore-connector/blob/master/scripts/add_snowflake_hive_metastore_connector_script_action.sh; https://github.com/snowflakedb/snowflake-hive-metastore-connector/commit/dfbf87dff456f6bb62c927711d97316f0c71d8ca; https://github.com/snowflakedb/snowflake-hive-metastore-connector/security/advisories/GHSA-r68p-g2x9-mq7x
CVE: CVE-2024-28854
Published: 2024-03-15
Description: tls-listener is a rust lang wrapper around a connection listener to support TLS. With the default configuration of tls-listener, a malicious user can open 6.4 `TcpStream`s a second, sending 0 bytes, and can trigger a DoS. The default configuration options make any public service using `TlsListener::new()` vulnerable to a slow-loris DoS attack. This impacts any publicly accessible service using the default configuration of tls-listener in versions prior to 0.10.0. Users are advised to upgrade. Users unable to upgrade may mitigate this by passing a large value, such as `usize::MAX` as the parameter to `Builder::max_handshakes`.


CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://en.wikipedia.org/wiki/Slowloris_(computer_security); https://github.com/tmccombs/tls-listener/commit/d5a7655d6ea9e53ab57c3013092c5576da964bc4; https://github.com/tmccombs/tls-listener/security/advisories/GHSA-2qph-qpvm-2qf7
CVE: CVE-2023-7248
Published: 2024-03-15
Description: 
Certain functionality in OpenText Vertica Management console might be prone to bypass via crafted requests. 

The vulnerability would affect one of Vertica’s authentication functionalities by allowing specially crafted requests and sequences. 
This issue impacts the following Vertica Management Console versions:
10.x
11.1.1-24 or lower
12.0.4-18 or lower

Please upgrade to one of the following Vertica Management Console versions:
10.x to upgrade to latest versions from below.
11.1.1-25
12.0.4-19
23.x
24.x


CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: https://portal.microfocus.com/s/article/KM000027542?language=en_US; https://portal.microfocus.com/s/article/KM000027542?language=en_US
CVE: CVE-2024-24748
Published: 2024-03-15
Description: Discourse is an open source platform for community discussion. In affected versions an attacker can learn that a secret subcategory exists under a public category which has no public subcategories. The issue is patched in the latest stable, beta and tests-passed version of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/discourse/discourse/commit/819361ba28f86a1347059af300bb5cca690f9193; https://github.com/discourse/discourse/security/advisories/GHSA-3qh8-xw23-cq4x; https://github.com/discourse/discourse/commit/819361ba28f86a1347059af300bb5cca690f9193
CVE: CVE-2024-24827
Published: 2024-03-15
Description: Discourse is an open source platform for community discussion. Without a rate limit on the POST /uploads endpoint, it makes it easier for an attacker to carry out a DoS attack on the server since creating an upload can be a resource intensive process. Do note that the impact varies from site to site as various site settings like `max_image_size_kb`, `max_attachment_size_kb` and `max_image_megapixels` will determine the amount of resources used when creating an upload. The issue is patched in the latest stable, beta and tests-passed version of Discourse. Users are advised to upgrade. Users unable to upgrade should reduce `max_image_size_kb`, `max_attachment_size_kb` and `max_image_megapixels` as smaller uploads require less resources to process. Alternatively, `client_max_body_size` can be reduced in Nginx to prevent large uploads from reaching the server.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400
References: https://github.com/discourse/discourse/commit/003b80e62f97cd8c0114d6b9d3f93c10443e6fae; https://github.com/discourse/discourse/security/advisories/GHSA-58vw-246g-fjj4; https://github.com/discourse/discourse/commit/003b80e62f97cd8c0114d6b9d3f93c10443e6fae