CVE-2023-30606

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-30606
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-30606.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-30606
Aliases
Published
2023-04-18T21:36:08Z
Modified
2026-09-29T11:46:01Z
Severity
  • 4.2 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Multisite denial of service through unsanitized dynamic dispatch to SiteSetting in Discourse
Details

Discourse is an open source platform for community discussion. In affected versions a user logged as an administrator can call arbitrary methods on the SiteSetting class, notably #clear_cache! and #notify_changed!, which when done on a multisite instance, can affect the entire cluster resulting in a denial of service. Users not running in multisite environments are not affected. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-732"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30606.json"
}
References

Affected packages

Git / github.com/discourse/discourse

Affected ranges

Type
GIT
Repo
https://github.com/discourse/discourse
Events
Introduced
e54f52a756c032d7f35c0907b03a7dc9f2ea65e5
Last Affected
6b5743ba3cc06da4f8978299c31360a297bfc41d
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "stable: < 3.0.2"
        },
        {
            "last_affected":  "stable: < 3.0.2"
        },
        {
            "introduced":  "beta: < 3.1.0.beta3"
        },
        {
            "last_affected":  "beta: < 3.1.0.beta3"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

beta: < 3.*
beta: < 3.1.0.beta3
stable: < 3.*
stable: < 3.0.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-30606.json"