CVE-2022-41921 (GCVE-0-2022-41921)
Vulnerability from cvelistv5 – Published: 2022-11-28 00:00 – Updated: 2025-04-23 16:34
VLAI?
Summary
Discourse is an open-source discussion platform. Prior to version 2.9.0.beta13, users can post chat messages of an unlimited length, which can cause a denial of service for other users when posting huge amounts of text. Users should upgrade to version 2.9.0.beta13, where a limit has been introduced. No known workarounds are available.
Severity ?
CWE
- CWE-20 - Improper Input Validation
Assigner
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T12:56:38.376Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-mfh7-6cv6-qccc"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/discourse/discourse/commit/3de765c89524a526ce611e11468d758a471a933f"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-41921",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-23T13:53:42.714025Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-23T16:34:31.783Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2.9.0.beta13"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to version 2.9.0.beta13, users can post chat messages of an unlimited length, which can cause a denial of service for other users when posting huge amounts of text. Users should upgrade to version 2.9.0.beta13, where a limit has been introduced. No known workarounds are available."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-11-28T00:00:00.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-mfh7-6cv6-qccc"
},
{
"url": "https://github.com/discourse/discourse/commit/3de765c89524a526ce611e11468d758a471a933f"
}
],
"source": {
"advisory": "GHSA-mfh7-6cv6-qccc",
"discovery": "UNKNOWN"
},
"title": "Discourse chat messages should have a maximum character limit"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2022-41921",
"datePublished": "2022-11-28T00:00:00.000Z",
"dateReserved": "2022-09-30T00:00:00.000Z",
"dateUpdated": "2025-04-23T16:34:31.783Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2.9.0\", \"matchCriteriaId\": \"A387C9DC-A3A5-416B-A564-DBD4F345972B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:discourse:discourse:2.9.0:beta1:*:*:*:*:*:*\", \"matchCriteriaId\": \"B3803EF9-A296-42B7-887F-93C5E68E94C4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:discourse:discourse:2.9.0:beta10:*:*:*:*:*:*\", \"matchCriteriaId\": \"35BAC488-3622-4B0B-B8EA-879E8C68E8CF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:discourse:discourse:2.9.0:beta11:*:*:*:*:*:*\", \"matchCriteriaId\": \"406A23B4-B971-4DC8-A132-EE9854FE8546\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:discourse:discourse:2.9.0:beta12:*:*:*:*:*:*\", \"matchCriteriaId\": \"1DD3C47F-E49F-4E19-9EA7-A322C4CFD541\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:discourse:discourse:2.9.0:beta2:*:*:*:*:*:*\", \"matchCriteriaId\": \"8BA3D313-3C11-43E2-A47D-CBB532D1B6F8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:discourse:discourse:2.9.0:beta3:*:*:*:*:*:*\", \"matchCriteriaId\": \"6F42673E-65F3-4807-9484-20CB747420FB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:discourse:discourse:2.9.0:beta4:*:*:*:*:*:*\", \"matchCriteriaId\": \"0B91D023-FCE5-4866-AD8B-BBB675763104\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:discourse:discourse:2.9.0:beta5:*:*:*:*:*:*\", \"matchCriteriaId\": \"0086484D-0164-449C-8AAE-BE7479CB9706\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:discourse:discourse:2.9.0:beta6:*:*:*:*:*:*\", \"matchCriteriaId\": \"F9D1B031-96C7-44C0-A0A0-F67ABE55C93C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:discourse:discourse:2.9.0:beta7:*:*:*:*:*:*\", \"matchCriteriaId\": \"750D2AD9-35E7-4AC7-9C22-AA90DAA34F3F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:discourse:discourse:2.9.0:beta8:*:*:*:*:*:*\", \"matchCriteriaId\": \"B68E308A-BDAB-4614-A563-4460F7996CBE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:discourse:discourse:2.9.0:beta9:*:*:*:*:*:*\", \"matchCriteriaId\": \"5DEDE4C5-2C2A-4B74-BB41-8AAA0EE636E2\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"Discourse is an open-source discussion platform. Prior to version 2.9.0.beta13, users can post chat messages of an unlimited length, which can cause a denial of service for other users when posting huge amounts of text. Users should upgrade to version 2.9.0.beta13, where a limit has been introduced. No known workarounds are available.\"}, {\"lang\": \"es\", \"value\": \"Discourse es una plataforma de discusi\\u00f3n de c\\u00f3digo abierto. Antes de la versi\\u00f3n 2.9.0.beta13, los usuarios pod\\u00edan publicar mensajes de chat de longitud ilimitada, lo que pod\\u00eda provocar una Denegaci\\u00f3n de Servicio (DoS) para otros usuarios al publicar grandes cantidades de texto. Los usuarios deben actualizar a la versi\\u00f3n 2.9.0.beta13, donde se introdujo un l\\u00edmite. No hay workarounds conocidos disponibles.\"}]",
"id": "CVE-2022-41921",
"lastModified": "2024-11-21T07:24:04.397",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L\", \"baseScore\": 3.5, \"baseSeverity\": \"LOW\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 2.1, \"impactScore\": 1.4}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L\", \"baseScore\": 4.3, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 1.4}]}",
"published": "2022-11-28T15:15:10.543",
"references": "[{\"url\": \"https://github.com/discourse/discourse/commit/3de765c89524a526ce611e11468d758a471a933f\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/discourse/discourse/security/advisories/GHSA-mfh7-6cv6-qccc\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://github.com/discourse/discourse/commit/3de765c89524a526ce611e11468d758a471a933f\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/discourse/discourse/security/advisories/GHSA-mfh7-6cv6-qccc\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}]",
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-20\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-770\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2022-41921\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2022-11-28T15:15:10.543\",\"lastModified\":\"2024-11-21T07:24:04.397\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Discourse is an open-source discussion platform. Prior to version 2.9.0.beta13, users can post chat messages of an unlimited length, which can cause a denial of service for other users when posting huge amounts of text. Users should upgrade to version 2.9.0.beta13, where a limit has been introduced. No known workarounds are available.\"},{\"lang\":\"es\",\"value\":\"Discourse es una plataforma de discusi\u00f3n de c\u00f3digo abierto. Antes de la versi\u00f3n 2.9.0.beta13, los usuarios pod\u00edan publicar mensajes de chat de longitud ilimitada, lo que pod\u00eda provocar una Denegaci\u00f3n de Servicio (DoS) para otros usuarios al publicar grandes cantidades de texto. Los usuarios deben actualizar a la versi\u00f3n 2.9.0.beta13, donde se introdujo un l\u00edmite. No hay workarounds conocidos disponibles.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L\",\"baseScore\":3.5,\"baseSeverity\":\"LOW\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.1,\"impactScore\":1.4},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L\",\"baseScore\":4.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.8,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-770\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.9.0\",\"matchCriteriaId\":\"A387C9DC-A3A5-416B-A564-DBD4F345972B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:discourse:discourse:2.9.0:beta1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B3803EF9-A296-42B7-887F-93C5E68E94C4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:discourse:discourse:2.9.0:beta10:*:*:*:*:*:*\",\"matchCriteriaId\":\"35BAC488-3622-4B0B-B8EA-879E8C68E8CF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:discourse:discourse:2.9.0:beta11:*:*:*:*:*:*\",\"matchCriteriaId\":\"406A23B4-B971-4DC8-A132-EE9854FE8546\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:discourse:discourse:2.9.0:beta12:*:*:*:*:*:*\",\"matchCriteriaId\":\"1DD3C47F-E49F-4E19-9EA7-A322C4CFD541\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:discourse:discourse:2.9.0:beta2:*:*:*:*:*:*\",\"matchCriteriaId\":\"8BA3D313-3C11-43E2-A47D-CBB532D1B6F8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:discourse:discourse:2.9.0:beta3:*:*:*:*:*:*\",\"matchCriteriaId\":\"6F42673E-65F3-4807-9484-20CB747420FB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:discourse:discourse:2.9.0:beta4:*:*:*:*:*:*\",\"matchCriteriaId\":\"0B91D023-FCE5-4866-AD8B-BBB675763104\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:discourse:discourse:2.9.0:beta5:*:*:*:*:*:*\",\"matchCriteriaId\":\"0086484D-0164-449C-8AAE-BE7479CB9706\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:discourse:discourse:2.9.0:beta6:*:*:*:*:*:*\",\"matchCriteriaId\":\"F9D1B031-96C7-44C0-A0A0-F67ABE55C93C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:discourse:discourse:2.9.0:beta7:*:*:*:*:*:*\",\"matchCriteriaId\":\"750D2AD9-35E7-4AC7-9C22-AA90DAA34F3F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:discourse:discourse:2.9.0:beta8:*:*:*:*:*:*\",\"matchCriteriaId\":\"B68E308A-BDAB-4614-A563-4460F7996CBE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:discourse:discourse:2.9.0:beta9:*:*:*:*:*:*\",\"matchCriteriaId\":\"5DEDE4C5-2C2A-4B74-BB41-8AAA0EE636E2\"}]}]}],\"references\":[{\"url\":\"https://github.com/discourse/discourse/commit/3de765c89524a526ce611e11468d758a471a933f\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/discourse/discourse/security/advisories/GHSA-mfh7-6cv6-qccc\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/discourse/discourse/commit/3de765c89524a526ce611e11468d758a471a933f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/discourse/discourse/security/advisories/GHSA-mfh7-6cv6-qccc\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/discourse/discourse/security/advisories/GHSA-mfh7-6cv6-qccc\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://github.com/discourse/discourse/commit/3de765c89524a526ce611e11468d758a471a933f\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T12:56:38.376Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-41921\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-04-23T13:53:42.714025Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-04-23T13:53:44.572Z\"}}], \"cna\": {\"title\": \"Discourse chat messages should have a maximum character limit\", \"source\": {\"advisory\": \"GHSA-mfh7-6cv6-qccc\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 3.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"discourse\", \"product\": \"discourse\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 2.9.0.beta13\"}]}], \"references\": [{\"url\": \"https://github.com/discourse/discourse/security/advisories/GHSA-mfh7-6cv6-qccc\"}, {\"url\": \"https://github.com/discourse/discourse/commit/3de765c89524a526ce611e11468d758a471a933f\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Discourse is an open-source discussion platform. Prior to version 2.9.0.beta13, users can post chat messages of an unlimited length, which can cause a denial of service for other users when posting huge amounts of text. Users should upgrade to version 2.9.0.beta13, where a limit has been introduced. No known workarounds are available.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-20\", \"description\": \"CWE-20: Improper Input Validation\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2022-11-28T00:00:00.000Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2022-41921\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-04-23T16:34:31.783Z\", \"dateReserved\": \"2022-09-30T00:00:00.000Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2022-11-28T00:00:00.000Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…