PT-2025-3161 · Discourse · Discourse

Taisehub · Publicado 2025-02-04 · Atualizado 2025-02-20 · CVE-2024-55948

Positive Technologies (AI Summary)

CVSS v3.1

8.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions Discourse versions prior to the latest version

Description Discourse is an open source platform for community discussion. In affected versions, an attacker can make a crafted XHR request to poison the anonymous cache, which may have a response with missing preloaded data. This issue only affects anonymous visitors of the site.

Recommendations For versions prior to the latest version, update to the latest version to resolve the issue. As a temporary workaround for users unable to upgrade, disable anonymous cache by setting the DISCOURSE DISABLE ANON CACHE environment variable to a non-empty value.

Exploit

Correção

Origin Validation Error

Enumeração de Fraquezas

CWE-346

Identificadores relacionados

BIT-DISCOURSE-2024-55948

CVE-2024-55948

GHSA-2352-252Q-QC82

Produtos afetados

Discourse

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/55xxx/CVE-2024-55948.json · Exploit
• https://github.com/discourse/discourse/security/advisories/GHSA-2352-252q-qc82 · Nota
• https://twitter.com/CVEnew/status/1886891655351201844 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2024-55948 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-55948 · Nota
• https://osv.dev/vulnerability/CVE-2024-55948 · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-discourse-2024-55948 · Aviso do Fabricante
• https://t.me/cvedetector/17249 · Publicação no Telegram