Discourse is an open-source discussion platform. Improperly sanitized user input could lead to an XSS vulnerability in some situations. This vulnerability only affects Discourse instances which have disabled the default Content Security Policy. The vulnerability is patched in 3.1.5 and 3.2.0.beta5. As a workaround, ensure Content Security Policy is enabled and does not include `unsafe-inline`.
References
| Link | Resource |
|---|---|
| https://github.com/discourse/discourse/commit/568d704a94c528b7c2cb0f3512a7b7b606bc3000 | Patch |
| https://github.com/discourse/discourse/security/advisories/GHSA-rj3g-8q6p-63pc | Vendor Advisory |
| https://meta.discourse.org/t/3-1-5-security-and-bug-fix-release/293094 | Release Notes Vendor Advisory |
| https://meta.discourse.org/t/3-2-0-beta5-add-groups-to-dms-mobile-chat-footer-redesign-passkeys-enabled-by-default-and-more/293093 | Release Notes Vendor Advisory |
| https://github.com/discourse/discourse/commit/568d704a94c528b7c2cb0f3512a7b7b606bc3000 | Patch |
| https://github.com/discourse/discourse/security/advisories/GHSA-rj3g-8q6p-63pc | Vendor Advisory |
| https://meta.discourse.org/t/3-1-5-security-and-bug-fix-release/293094 | Release Notes Vendor Advisory |
| https://meta.discourse.org/t/3-2-0-beta5-add-groups-to-dms-mobile-chat-footer-redesign-passkeys-enabled-by-default-and-more/293093 | Release Notes Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 08:58
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.3 |
| References | () https://github.com/discourse/discourse/commit/568d704a94c528b7c2cb0f3512a7b7b606bc3000 - Patch | |
| References | () https://github.com/discourse/discourse/security/advisories/GHSA-rj3g-8q6p-63pc - Vendor Advisory | |
| References | () https://meta.discourse.org/t/3-1-5-security-and-bug-fix-release/293094 - Release Notes, Vendor Advisory | |
| References | () https://meta.discourse.org/t/3-2-0-beta5-add-groups-to-dms-mobile-chat-footer-redesign-passkeys-enabled-by-default-and-more/293093 - Release Notes, Vendor Advisory |
08 Feb 2024, 16:39
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:discourse:discourse:3.2.0:beta2:*:*:beta:*:*:* cpe:2.3:a:discourse:discourse:3.2.0:beta1:*:*:beta:*:*:* cpe:2.3:a:discourse:discourse:3.2.0:beta4:*:*:beta:*:*:* cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:* cpe:2.3:a:discourse:discourse:3.2.0:beta3:*:*:beta:*:*:* cpe:2.3:a:discourse:discourse:*:*:*:*:beta:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
| First Time |
Discourse
Discourse discourse |
|
| References | () https://github.com/discourse/discourse/commit/568d704a94c528b7c2cb0f3512a7b7b606bc3000 - Patch | |
| References | () https://github.com/discourse/discourse/security/advisories/GHSA-rj3g-8q6p-63pc - Vendor Advisory | |
| References | () https://meta.discourse.org/t/3-1-5-security-and-bug-fix-release/293094 - Release Notes, Vendor Advisory | |
| References | () https://meta.discourse.org/t/3-2-0-beta5-add-groups-to-dms-mobile-chat-footer-redesign-passkeys-enabled-by-default-and-more/293093 - Release Notes, Vendor Advisory |
30 Jan 2024, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-01-30 22:15
Updated : 2024-11-21 08:58
NVD link : CVE-2024-23834
Mitre link : CVE-2024-23834
CVE.ORG link : CVE-2024-23834
JSON object : View
Products Affected
discourse
- discourse
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')