CVE-2022-23548

Summary

Discourse is an option source discussion platform. Prior to version 2.8.14 on the stable branch and version 2.9.0.beta16 on the beta and tests-passed branches, parsing posts can be susceptible to regular expression denial of service (ReDoS) attacks. This issue is patched in versions 2.8.14 and 2.9.0.beta16. There are no known workarounds.

Affected Software

VendorProductVersion RangeStatus
discoursediscourse< 2.8.14affected
discoursediscourse>= 2.9.0.beta0, < 2.9.0.beta16affected

Weaknesses

  • CWE-1333: CWE-1333: Inefficient Regular Expression Complexity

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References