PT-2025-3161 · Discourse · Discourse

Taisehub · Published 2025-02-04 · Updated 2025-02-20 · CVE-2024-55948

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions Discourse versions prior to the latest version

Description Discourse is an open source platform for community discussion. In affected versions, an attacker can make a crafted XHR request to poison the anonymous cache, which may have a response with missing preloaded data. This issue only affects anonymous visitors of the site.

Recommendations For versions prior to the latest version, update to the latest version to resolve the issue. As a temporary workaround for users unable to upgrade, disable anonymous cache by setting the DISCOURSE DISABLE ANON CACHE environment variable to a non-empty value.

Exploit

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

BIT-DISCOURSE-2024-55948

CVE-2024-55948

GHSA-2352-252Q-QC82

Affected Products

Discourse

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/55xxx/CVE-2024-55948.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-55948 · Security Note
• https://osv.dev/vulnerability/CVE-2024-55948 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-discourse-2024-55948 · Vendor Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-2352-252q-qc82 · Note
• https://twitter.com/CVEnew/status/1886891655351201844 · Twitter Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-55948 · Note
• https://t.me/cvedetector/17249 · Telegram Post