Discourse 3.0.0 Beta 15
Approved changes feed: RSS · Atom
cpe:2.3:a:discourse:discourse:3.0.0:beta15:*:*:*:*:*:*
part: a version: 3.0.0 update: beta15
| Vendor | Discourse (2d3c125b-857a-5933-b846-ed7f9d5e0225) |
|---|---|
| Product | Discourse (4347364d-ae10-5ab6-a9ec-6e7dcaf78dd8) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/discourse/discourse |
purl2cpe | 2026-06-01 10:13:03.519123 |
pkg:rpm/opensuse/discourse |
purl2cpe | 2026-06-01 10:13:03.519124 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2022-46168 |
vulnerable | 2026-06-03 14:48:25.622280 |
Group SMTP user emails are exposed in CC email header
LOW (3.5)
Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 2.9.0.beta15 on the `beta` and `tests-passed` branches, recipients of a group SMTP email could see the email addresses of all other users inside the group SMTP topic. Most of the time this is not an issue as they are likely already familiar with one another's email addresses. This issue is patched in versions 2.8.14 and 2.9.0.beta15. The fix is that someone sending emails out via group SMTP to non-staged users masks those emails with blind carbon copy (BCC). Staged users are ones that have likely only interacted with the group via email, and will likely include other people who were CC'd on the original email to the group. As a workaround, disable group SMTP for any groups that have it enabled.
Published: 2023-01-05T17:18:58.143Z
Updated: 2025-03-10T21:32:09.707Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-23549 |
vulnerable | 2026-06-03 14:46:27.656932 |
Discourse vulnerable to bypass of post max_length using HTML comments
MEDIUM (5.7)
Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 2.9.0.beta16 on the `beta` and `tests-passed` branches, users can create posts with raw body longer than the `max_length` site setting by including html comments that are not counted toward the character limit. This issue is patched in versions 2.8.14 and 2.9.0.beta16. There are no known workarounds.
Published: 2023-01-05T00:00:00.000Z
Updated: 2025-03-10T21:32:15.478Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-23548 |
vulnerable | 2026-06-03 14:46:27.656119 |
Details available
MEDIUM (6.5)
Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 2.9.0.beta16 on the `beta` and `tests-passed` branches, parsing posts can be susceptible to regular expression denial of service (ReDoS) attacks. This issue is patched in versions 2.8.14 and 2.9.0.beta16. There are no known workarounds.
Published: 2023-01-05T00:00:00.000Z
Updated: 2025-03-10T21:32:22.096Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.