PT-2025-3011 · Discourse · Discourse

Jomaxro · Published 2025-02-04 · Updated 2025-08-26 · CVE-2024-53994

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to the latest version

Description The issue affects users who disable chat in preferences but could still be reachable in some cases. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

Recommendations For versions prior to the latest version, upgrade to the latest version of Discourse. As a temporary workaround for users unable to upgrade, disable the chat plugin within site settings.

Exploit

Fix

Improper Preservation of Permissions

Weakness Enumeration

CWE-281

Related Identifiers

BIT-DISCOURSE-2024-53994

CVE-2024-53994

GHSA-MRPW-GWJ7-98R6

Affected Products

Discourse

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53994.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-53994 · Security Note
• https://osv.dev/vulnerability/BIT-discourse-2024-53994 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-53994 · Vendor Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-mrpw-gwj7-98r6 · Note
• https://t.me/cvedetector/17243 · Telegram Post
• https://t.me/cveNotify/133512 · Telegram Post
• https://twitter.com/CVEnew/status/1886891654516498612 · Twitter Post