PT-2024-20113 · Discourse · Discourse

Gingermanymph · Published 2024-01-30 · Updated 2024-03-06 · CVE-2024-23834

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.1.5 Discourse versions prior to 3.2.0.beta5

Description Discourse is an open-source discussion platform. Improperly sanitized user input could lead to an XSS issue in some situations. This issue only affects Discourse instances which have disabled the default Content Security Policy.

Recommendations For versions prior to 3.1.5, update to version 3.1.5 or later. For versions prior to 3.2.0.beta5, update to version 3.2.0.beta5 or later. As a temporary workaround, ensure Content Security Policy is enabled and does not include unsafe-inline.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-DISCOURSE-2024-23834

CVE-2024-23834

GHSA-RJ3G-8Q6P-63PC

Affected Products

Discourse

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23834.json · Exploit
• https://github.com/discourse/discourse/security/advisories/GHSA-rj3g-8q6p-63pc · Vendor Advisory
• https://github.com/discourse/discourse/commit/568d704a94c528b7c2cb0f3512a7b7b606bc3000 · Patch
• https://meta.discourse.org/t/3-2-0-beta5-add-groups-to-dms-mobile-chat-footer-redesign-passkeys-enabled-by-default-and-more/293093 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23834 · Security Note
• https://meta.discourse.org/t/3-1-5-security-and-bug-fix-release/293094 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-discourse-2024-23834 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-23834 · Vendor Advisory
• https://twitter.com/RedPacketSec/status/1754083395661975951 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1752477021660176470 · Twitter Post
• https://twitter.com/CVEnew/status/1752449715344457899 · Twitter Post
• https://t.me/cvenotify/69321 · Telegram Post