Open source discussion platform vulnerability fix

CVE-2024-39320

6.1MEDIUM

Key Information

Vendor: Discourse
Status: Discourse
Vendor: CVE Published:; 30 July 2024

Summary

Discourse is an open source discussion platform. Prior to 3.2.5 and 3.3.0.beta5, the vulnerability allows an attacker to inject iframes from any domain, bypassing the intended restrictions enforced by the allowed_iframes setting. This vulnerability is fixed in 3.2.5 and 3.3.0.beta5.

Affected Version(s)

discourse < 3.2.5

discourse < 3.3.0.beta1, 3.3.0.beta5

CVSS V3.1

Score:

6.1

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Changed

Timeline

Vulnerability published.
Jul 30, 2024
Vulnerability Reserved.
Jun 21, 2024

Collectors

NVD DatabaseMitre Database