CVE-2024-35234

Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch, an attacker can execute arbitrary JavaScript on users’ browsers by posting a specific URL containing maliciously crafted meta tags. This issue only affects sites with Content Security Polic (CSP) disabled. The problem has been patched in version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch. As a workaround, ensure CSP is enabled on the forum.

CVSS v3 4.2 MEDIUM

4.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/discourse/discourse/commit/26aef0c288839378b9de5819e96eac8cf4ea60fd	Patch
https://github.com/discourse/discourse/commit/311b737c910cf0a69f61e1b8bc0b78374b6619d2	Patch
https://github.com/discourse/discourse/security/advisories/GHSA-5chg-hm8c-wc58	Third Party Advisory
https://github.com/discourse/discourse/commit/26aef0c288839378b9de5819e96eac8cf4ea60fd	Patch
https://github.com/discourse/discourse/commit/311b737c910cf0a69f61e1b8bc0b78374b6619d2	Patch
https://github.com/discourse/discourse/security/advisories/GHSA-5chg-hm8c-wc58	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:discourse:discourse:::::stable:::*
	cpe:2.3:a:discourse:discourse:::::beta:::*
	cpe:2.3:a:discourse:discourse:3.3.0:beta1:::beta:::*
	cpe:2.3:a:discourse:discourse:3.3.0:beta2:::beta:::*

History

No history.

Information

Published : 2024-07-03 19:15

Updated : 2024-11-21 09:19

NVD link : CVE-2024-35234

Mitre link : CVE-2024-35234

CVE.ORG link : CVE-2024-35234

JSON object : View

Products Affected

discourse

discourse

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2024-35234", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.2, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2024-07-03T19:15:04.123", "references": [{"url": "https://github.com/discourse/discourse/commit/26aef0c288839378b9de5819e96eac8cf4ea60fd", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/discourse/discourse/commit/311b737c910cf0a69f61e1b8bc0b78374b6619d2", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/discourse/discourse/security/advisories/GHSA-5chg-hm8c-wc58", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/discourse/discourse/commit/26aef0c288839378b9de5819e96eac8cf4ea60fd", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/discourse/discourse/commit/311b737c910cf0a69f61e1b8bc0b78374b6619d2", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/discourse/discourse/security/advisories/GHSA-5chg-hm8c-wc58", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch, an attacker can execute arbitrary JavaScript on users\u2019 browsers by posting a specific URL containing maliciously crafted meta tags. This issue only affects sites with Content Security Polic (CSP) disabled. The problem has been patched in version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch. As a workaround, ensure CSP is enabled on the forum."}, {"lang": "es", "value": "Discourse es una plataforma de discusi\u00f3n de c\u00f3digo abierto. Antes de la versi\u00f3n 3.2.3 en la rama \"estable\" y la versi\u00f3n 3.3.0.beta3 en la rama \"pruebas aprobadas\", un atacante pod\u00eda ejecutar JavaScript arbitrario en los navegadores de los usuarios publicando una URL espec\u00edfica que conten\u00eda metaetiquetas creadas con fines malintencionados. Este problema solo afecta a sitios con la Pol\u00edtica de seguridad de contenido (CSP) deshabilitada. El problema se solucion\u00f3 en la versi\u00f3n 3.2.3 en la rama \"estable\" y en la versi\u00f3n 3.3.0.beta3 en la rama \"pruebas aprobadas\". Como workaround, aseg\u00farese de que CSP est\u00e9 habilitado en el foro."}], "lastModified": "2024-11-21T09:19:59.373", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*", "vulnerable": true, "matchCriteriaId": "8F15A89F-6283-4B24-801E-E415FF5A4272", "versionEndExcluding": "3.2.3"}, {"criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:beta:*:*:*", "vulnerable": true, "matchCriteriaId": "4EBDB0A9-6C68-4FC5-81CD-5E1B042DD60C", "versionEndExcluding": "3.3.0"}, {"criteria": "cpe:2.3:a:discourse:discourse:3.3.0:beta1:*:*:beta:*:*:*", "vulnerable": true, "matchCriteriaId": "4FE1C6B5-D21B-46CC-A889-EECE10A7130A"}, {"criteria": "cpe:2.3:a:discourse:discourse:3.3.0:beta2:*:*:beta:*:*:*", "vulnerable": true, "matchCriteriaId": "51C031F6-729E-4560-B33D-382177F2DB7D"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}