CVE-2024-35234
Severity CVSS v4.0:
Pending analysis
Type:
CWE-79
Cross-Site Scripting (XSS)
Publication date:
03/07/2024
Last modified:
18/09/2024
Description
Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch, an attacker can execute arbitrary JavaScript on users’ browsers by posting a specific URL containing maliciously crafted meta tags. This issue only affects sites with Content Security Polic (CSP) disabled. The problem has been patched in version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch. As a workaround, ensure CSP is enabled on the forum.
Impact
Base Score 3.x
6.10
Severity 3.x
MEDIUM
Vulnerable products and versions
CPE | From | Up to |
---|---|---|
cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:* | 3.2.3 (excluding) | |
cpe:2.3:a:discourse:discourse:*:*:*:*:beta:*:*:* | 3.3.0 (excluding) | |
cpe:2.3:a:discourse:discourse:3.3.0:beta1:*:*:beta:*:*:* | ||
cpe:2.3:a:discourse:discourse:3.3.0:beta2:*:*:beta:*:*:* |
To consult the complete list of CPE names with products and versions, see this page