Open Source Community Discussion Platform Vulnerability in Discourse
CVE-2024-53994

4.3MEDIUM

Key Information:

Vendor
Discourse
Status
Discourse
Vendor
CVE Published:
4 February 2025

Summary

A vulnerability in the Discourse community discussion platform allows users who have disabled chat preferences to still be reachable under certain conditions. This flaw highlights an improper configuration within the platform regarding user privacy settings. The issue has been addressed in the latest release of Discourse, and users are encouraged to upgrade promptly. For those unable to perform the upgrade, the temporary solution is to disable the chat plugin via site settings to mitigate potential risks.

Affected Version(s)

discourse stable: <= 3.3.2 <= stable: 3.3.2

discourse beta: <= 3.4.0.beta3 <= beta: 3.4.0.beta3

discourse tests-passed: <= 3.4.0.beta3 <= tests-passed: 3.4.0.beta3

References

https://github.com/discourse/discourse/security/advisorie...
x_refsource_CONFIRM

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.