PT-2025-40288 · Discourse · Discourse

Tgxworld · Publicado 2025-10-01 · Atualizado 2025-10-23 · CVE-2025-58054

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.5.1

Description Discourse, an open-source community discussion platform, is affected by a cross-site scripting (XSS) issue. The issue stems from how the platform parses and renders chat channel titles and chat thread titles using the quote message functionality with the rich text editor. This allows for the execution of malicious scripts through crafted titles.

Recommendations Update to version 3.5.1 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-80

Identificadores relacionados

BIT-DISCOURSE-2025-58054

CVE-2025-58054

GHSA-7P47-8M82-M2VF

Produtos afetados

Discourse

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58054.json · Exploit
• https://github.com/discourse/discourse/commit/3a224fd546d894ee408e7414b6879e814a792f91 · Correção
• https://github.com/discourse/discourse/security/advisories/GHSA-7p47-8m82-m2vf · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1973560654708584918 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1973469328038138336 · Publicação no Twitter
• https://osv.dev/vulnerability/BIT-discourse-2025-58054 · Aviso do Fabricante
• https://t.me/CVEtracker/33867 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-58054 · Nota de Segurança
• https://t.me/cveNotify/140027 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-58054 · Aviso do Fabricante