BIT-discourse-2024-35234
See a problem?- Import Source
- https://github.com/bitnami/vulndb/tree/main/data/discourse/BIT-discourse-2024-35234.json
- JSON Data
- https://api.osv.dev/v1/vulns/BIT-discourse-2024-35234
- Aliases
- Published
- 2024-07-09T08:43:42.054Z
- Modified
- 2025-04-03T14:40:37.652Z
- Summary
- [none]
- Details
-
Discourse is an open-source discussion platform. Prior to version 3.2.3 on the
stablebranch and version 3.3.0.beta3 on thetests-passedbranch, an attacker can execute arbitrary JavaScript on users’ browsers by posting a specific URL containing maliciously crafted meta tags. This issue only affects sites with Content Security Polic (CSP) disabled. The problem has been patched in version 3.2.3 on thestablebranch and version 3.3.0.beta3 on thetests-passedbranch. As a workaround, ensure CSP is enabled on the forum. - Database specific
{ "cpes": [ "cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*" ], "severity": "Medium" }- References
-
- https://github.com/discourse/discourse/commit/26aef0c288839378b9de5819e96eac8cf4ea60fd
- https://github.com/discourse/discourse/commit/311b737c910cf0a69f61e1b8bc0b78374b6619d2
- https://github.com/discourse/discourse/security/advisories/GHSA-5chg-hm8c-wc58
- https://nvd.nist.gov/vuln/detail/CVE-2024-35234
Affected packages
Bitnami / discourse
Package
- Name
- discourse
- Purl
- pkg:bitnami/discourse
Severity
- 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator