Discourse is an open source platform for community discussion. Without a rate limit on the POST /uploads endpoint, it makes it easier for an attacker to carry out a DoS attack on the server since creating an upload can be a resource intensive process. Do note that the impact varies from site to site as various site settings like max_image_size_kb
, max_attachment_size_kb
and max_image_megapixels
will determine the amount of resources used when creating an upload. The issue is patched in the latest stable, beta and tests-passed version of Discourse. Users are advised to upgrade. Users unable to upgrade should reduce max_image_size_kb
, max_attachment_size_kb
and max_image_megapixels
as smaller uploads require less resources to process. Alternatively, client_max_body_size
can be reduced in Nginx to prevent large uploads from reaching the server.
{ "cpes": [ "cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*", "cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*" ], "severity": "Medium" }