Carefully crafted malicious URL can reduce Discourse instance availability
CVE-2024-35227
7.5HIGH
Key Information:
What is CVE-2024-35227?
A vulnerability exists in the Discourse open-source discussion platform where the Oneboxing feature can be exploited using a carefully crafted malicious URL. This may lead to reduced availability of the Discourse instance. The vulnerability impacts versions prior to 3.2.3 on the stable branch and 3.3.0.beta3 on the tests-passed branch. Users are advised to upgrade to the specified patched versions, as there are currently no workarounds available to mitigate this issue.
Affected Version(s)
discourse stable < 3.2.3 < stable 3.2.3
discourse tests-passed < 3.3.0.beta3 < tests-passed 3.3.0.beta3