PT-2025-3019 · Discourse · Discourse Ai

Jomaxro + 1 · Published 2025-01-14 · Updated 2025-01-15 · CVE-2024-54142

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Discourse AI (affected versions not specified)

Description The issue concerns the Discourse AI plugin, which provides AI features. When sharing conversations from the Discourse AI Bot into posts, HTML entities from the conversation could leak into the Discourse application if a user visits a post with a onebox for that conversation. This problem has been addressed in commit 92f122c.

Recommendations For all affected versions, update to a version that includes the fix from commit 92f122c. As a temporary workaround for users unable to update, remove all groups from the ai bot public sharing allowed groups site setting.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-54142

GHSA-94C2-QR2H-88JV

Affected Products

Discourse Ai

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/54xxx/CVE-2024-54142.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-54142 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-54142 · Security Note
• https://github.com/discourse/discourse-ai/commit/92f122c54d9d7ead9223a056270bff5b4c42c73f · Note
• https://github.com/discourse/discourse-ai/security/advisories/GHSA-94c2-qr2h-88jv · Note
• https://t.me/cvedetector/15387 · Telegram Post
• https://t.me/cvenotify/107402 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1879436298475253919 · Twitter Post
• https://twitter.com/CVEnew/status/1879490172863295500 · Twitter Post