CVE-2024-35234

Summary

Discourse is an open-source discussion platform. Prior to version 3.2.3 on the stable branch and version 3.3.0.beta3 on the tests-passed branch, an attacker can execute arbitrary JavaScript on users’ browsers by posting a specific URL containing maliciously crafted meta tags. This issue only affects sites with Content Security Polic (CSP) disabled. The problem has been patched in version 3.2.3 on the stable branch and version 3.3.0.beta3 on the tests-passed branch. As a workaround, ensure CSP is enabled on the forum.

Affected Software

VendorProductVersion RangeStatus
discoursediscoursestable < 3.2.3affected
discoursediscoursetests-passed < 3.3.0.beta3affected

Weaknesses

  • CWE-79: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

CVE Program Container

Additional References

References