SB2024031559 - Multiple vulnerabilities in Discourse

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2024031559

SB2024031559 - Multiple vulnerabilities in Discourse

Published: March 15, 2024 Updated: July 1, 2026

Security Bulletin ID SB2024031559
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 60% Low 40%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Improper Authorization (CVE-ID: CVE-2024-24748)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper authorization in secret subcategory handling when accessing a public category with no public subcategories. A remote attacker can determine that a secret subcategory exists to disclose sensitive information.


2) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2024-24827)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource management in the POST /uploads endpoint when handling upload creation requests. A remote attacker can send a large number of upload requests to cause a denial of service.

The impact depends on site-specific upload-related settings that affect the resources consumed during upload creation.


3) Input validation error (CVE-ID: CVE-2024-27085)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper input validation in the invite route when handling invite parameters. A remote user can send arbitrarily large data in invite parameters to cause a denial of service.

Exploitation requires permission to invite other users.


4) Resource exhaustion (CVE-ID: CVE-2024-27100)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the user suspension, user silencing, and CSV export endpoints when handling oversized parameters. A remote user can send crafted requests with large parameter values to cause a denial of service.

In multisite deployments, exploitation may be performed by a staff member on another site in the same cluster.


5) Improper Authorization (CVE-ID: CVE-2024-28242)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper authorization in secret categories with custom backgrounds when rendering category backgrounds. A remote attacker can access affected content handling to disclose sensitive information.

The issue can reveal the existence of secret categories when category backgrounds are set.


Remediation

Install update from vendor's website.

References