CVE-2022-23549

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-23549
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-23549.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-23549
Aliases
Published
2023-01-05T00:00:00Z
Modified
2026-10-28T02:30:44Z
Severity
  • 5.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Discourse vulnerable to bypass of post max_length using HTML comments
Details

Discourse is an option source discussion platform. Prior to version 2.8.14 on the stable branch and version 2.9.0.beta16 on the beta and tests-passed branches, users can create posts with raw body longer than the max_length site setting by including html comments that are not counted toward the character limit. This issue is patched in versions 2.8.14 and 2.9.0.beta16. There are no known workarounds.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-20"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23549.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "2.9.0.beta0"
                        },
                        {
                            "last_affected":  "2.9.0.beta0"
                        },
                        {
                            "introduced":  "2.9.0.beta16"
                        },
                        {
                            "last_affected":  "2.9.0.beta16"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "StandaloneSingleVersion"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/discourse/discourse

Affected ranges

Type
GIT
Repo
https://github.com/discourse/discourse
Events
Introduced
df6d323bd187746e254538c81ed29181efc2abe3
Fixed
bf6b08670a927cc80bb090b7a2e710b4b554e6a8
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "2.8.14"
                },
                {
                    "last_affected":  "2.8.14"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "fixed":  "bf6b08670a927cc80bb090b7a2e710b4b554e6a8"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

2.*
2.8.14
2.9.0-beta1
2.9.0-beta10
2.9.0-beta11
2.9.0-beta12
2.9.0-beta13
2.9.0-beta14
2.9.0-beta2
2.9.0-beta3
2.9.0-beta4
2.9.0-beta5
2.9.0-beta6
2.9.0-beta7
2.9.0-beta8
3.*
3.0.0-beta15

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-23549.json"