PT-2025-2994 · Discourse · Discourse

Taisehub · Published 2025-02-04 · Updated 2025-09-26 · CVE-2024-53851

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Discourse versions prior to the latest stable, beta and tests-passed versions

Description The issue is related to the endpoint for generating inline oneboxes for URLs, which did not enforce limits on the number of URLs accepted, allowing a malicious user to inflict a denial of service on some parts of the application. This can only be exploited by authenticated users.

Recommendations For versions prior to the latest stable, beta and tests-passed versions, update to the latest version to resolve the issue. For users unable to update, as a temporary workaround, turn off the enable inline onebox on all domains site setting and remove all entries from the allowed inline onebox domains site setting.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BIT-DISCOURSE-2024-53851

CVE-2024-53851

GHSA-49RV-574X-WGPC

Affected Products

Discourse

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53851.json · Exploit
• https://github.com/discourse/discourse/commit/416ec83ae57924d721e6e374f4cda78bd77a4599 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-53851 · Security Note
• https://osv.dev/vulnerability/BIT-discourse-2024-53851 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-53851 · Vendor Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-49rv-574x-wgpc · Note
• https://t.me/cveNotify/136547 · Telegram Post
• https://t.me/cvedetector/17247 · Telegram Post
• https://twitter.com/CVEnew/status/1886891653698609662 · Twitter Post