CVE-2023-28440— Denial of service via admin theme import route in Discourse
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2023-28440
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Denial of service via admin theme import route in Discourse
Source: NVD (National Vulnerability Database)
Vulnerability Description
Discourse is an open source platform for community discussion. In affected versions a maliciously crafted request from a Discourse administrator can lead to a long-running request and eventual timeout. This has the greatest potential impact in shared hosting environments where admins are untrusted. This issue has been addressed in versions 3.0.3 and 3.1.0.beta4. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Discourse 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Discourse是一套开源的社区讨论平台。该平台包括社区、电子邮件和聊天室等功能。 Discourse存在资源管理错误漏洞，该漏洞源于来自 Discourse 管理员的恶意请求可能会导致请求长时间运行并最终超时。受影响的产品和版本：Discourse stable <= 3.0.2及之前版本，beta 3.1.0.beta3及之前版本，tests-passed 3.1.0.beta3及之前版本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2023-28440
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-28440
请登录查看更多情报信息。
Same Patch Batch · discourse · 2023-04-18 · 4 CVEs total
| CVE-2023-30538 | 5.4 MEDIUM | Stored Cross-site Scripting via improper sanitization of svg files in Discourse |
| CVE-2023-30606 | 4.2 MEDIUM | Multisite denial of service through unsanitized dynamic dispatch to SiteSetting in Discour |
| CVE-2023-29196 | 4.2 MEDIUM | HTML injection via topic embedding in Discourse |
IV. Related Vulnerabilities
Same product: discourse
- CVE-2026-34947
Discourse: Staged user custom fields are exposed on public i - CVE-2026-27481
Discourse: Hidden tag visibility bypass on tag routes - CVE-2026-33415
Discourse: Improper Access Control in discourse-ai Allows Un - CVE-2026-33300
Discourse: Hidden group names and access metadata are expose - CVE-2026-33185
Discourse: Group SMTP test endpoint susceptible to SSRF
Same vendor: discourse
- CVE-2026-34947
Discourse: Staged user custom fields are exposed on public i - CVE-2026-27481
Discourse: Hidden tag visibility bypass on tag routes - CVE-2026-33415
Discourse: Improper Access Control in discourse-ai Allows Un - CVE-2026-33300
Discourse: Hidden group names and access metadata are expose - CVE-2026-33185
Discourse: Group SMTP test endpoint susceptible to SSRF
Same weakness: CWE-400
- CVE-2026-8187
Open5GS UPF gtp-path.c _gtpv1_u_recv_cb resource consumption - CVE-2026-42343
FastGPT: Uncontrolled Resource Consumption leading to Sandbo - CVE-2026-42212
SolidCAM-GPPL-IDE: XML External Entity (XXE) and billion-lau - CVE-2026-32686
Unbounded exponent in decimal enables unauthenticated DoS - CVE-2026-20188
Cisco Crosswork Network Controller and Cisco Network Service
V. Comments for CVE-2023-28440
No comments yet