SB2022112928 - Multiple vulnerabilities in Discourse

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Input validation error (CVE-ID: CVE-2022-41921)

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to missing limits on the amount of text published by application users. A remote user post a chat message of an unlimited lengt and perform a denial of service (DoS) attack.

2) Improper access control (CVE-ID: CVE-2022-41944)

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote user can see notifications for topics they no longer have access to.

Remediation

Install update from vendor's website.

References

• https://github.com/discourse/discourse/security/advisories/GHSA-mfh7-6cv6-qccc
• https://github.com/discourse/discourse/commit/3de765c89524a526ce611e11468d758a471a933f
• https://github.com/discourse/discourse/commit/c6ee28ec756436cc9ce154dd2c8e4c441f92f693
• https://github.com/discourse/discourse/security/advisories/GHSA-354r-jpj5-53c2