VYPR
← All advisories
High severity8.6NVD Advisory· Published Jan 12, 2024· Updated Jun 17, 2026

CVE-2023-48297

CVE-2023-48297

Description

Discourse is a platform for community discussion. The message serializer uses the full list of expanded chat mentions (@all and @here) which can lead to a very long array of users. This issue was patched in versions 3.1.4 and beta 3.2.0.beta5.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

7
  • Discourse (software)/Discourse6 versions
    cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*+ 5 more
    • cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*range: <3.1.4
    • cpe:2.3:a:discourse:discourse:3.2.0:beta1:*:*:beta:*:*:*
    • cpe:2.3:a:discourse:discourse:3.2.0:beta2:*:*:beta:*:*:*
    • cpe:2.3:a:discourse:discourse:3.2.0:beta3:*:*:beta:*:*:*
    • (no CPE)range: before 3.1.4 and beta 3.2.0.beta5
    • (no CPE)range: < 3.1.4
  • osv-coords
    pkg:bitnami/discourse
    Range: < 3.1.4

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.