CVE-2023-48297 — Discourse vulnerable to unlimited mentioned users in message serializer
Discourse is a platform for community discussion. The message serializer uses the full list of expanded chat mentions (@all and @here) which can lead to a very long array of use…
Published: 2024-01-12 · CVSS: 8.6 · CVSS 3.1
Discourse is a platform for community discussion. The message serializer uses the full list of expanded chat mentions (@all and @here) which can lead to a very long array of users. This issue was patched in versions 3.1.4 and beta 3.2.0.beta5.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7