PT-2025-33751 · Discourse · Discourse

Tgxworld · Published 2025-08-19 · Updated 2025-08-21 · CVE-2025-54411

Positive Technologies (AI Summary)

CVSS v4.0

2.4

Low

Base vector

AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.5.0.beta8

Description: Discourse, an open-source discussion platform, contains a cross-site scripting (XSS) issue in the welcome banner user name string for logged-in users. This can affect the user or an administrator impersonating them.

Recommendations: Update to version 3.5.0.beta8 or later. As a temporary workaround, administrators can alter the welcome banner.header.logged in members site text to remove the preferred display name placeholder. Administrators can avoid impersonating any users for the time being.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-DISCOURSE-2025-54411

CVE-2025-54411

GHSA-5MM6-J5VQ-6884

Affected Products

Discourse

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54411.json · Exploit
• https://osv.dev/vulnerability/BIT-discourse-2025-54411 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-54411 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54411 · Security Note
• https://github.com/discourse/discourse/commit/a3374d2850f07444d113216e1d539ee21650dbff · Note
• https://github.com/discourse/discourse/security/advisories/GHSA-5mm6-j5vq-6884 · Note
• https://twitter.com/CVEnew/status/1957849675412959337 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1957913015677837377 · Twitter Post