CVE-2023-28440

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-28440
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-28440.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-28440
Aliases
Published
2023-04-18T20:40:13Z
Modified
2026-09-29T11:47:00Z
Severity
  • 2.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
Denial of service via admin theme import route in Discourse
Details

Discourse is an open source platform for community discussion. In affected versions a maliciously crafted request from a Discourse administrator can lead to a long-running request and eventual timeout. This has the greatest potential impact in shared hosting environments where admins are untrusted. This issue has been addressed in versions 3.0.3 and 3.1.0.beta4. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-400"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28440.json"
}
References

Affected packages

Git / github.com/discourse/discourse

Affected ranges

Type
GIT
Repo
https://github.com/discourse/discourse
Events
Introduced
e54f52a756c032d7f35c0907b03a7dc9f2ea65e5
Last Affected
6b5743ba3cc06da4f8978299c31360a297bfc41d
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "stable: <= 3.0.2"
        },
        {
            "last_affected":  "stable: <= 3.0.2"
        },
        {
            "introduced":  "beta: <= 3.1.0.beta3"
        },
        {
            "last_affected":  "beta: <= 3.1.0.beta3"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

beta: <= 3.*
beta: <= 3.1.0.beta3
stable: <= 3.*
stable: <= 3.0.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-28440.json"