CVE-2024-37165

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-37165

6.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

D

iscourse is an open source discussion platform. Prior to 3.2.3 and 3.3.0.beta3, improperly sanitized Onebox data could lead to an XSS vulnerability in some situations. This vulnerability only affects Discourse instances which have disabled the default Content Security Policy. This vulnerability is fixed in 3.2.3 and 3.3.0.beta3.

References
Link Resource
https://github.com/discourse/discourse/commit/26aef0c288839378b9de5819e96eac8cf4ea60fd Patch
https://github.com/discourse/discourse/commit/311b737c910cf0a69f61e1b8bc0b78374b6619d2 Patch
https://github.com/discourse/discourse/security/advisories/GHSA-cx83-5p6x-9qh9 Vendor Advisory
https://github.com/discourse/discourse/commit/26aef0c288839378b9de5819e96eac8cf4ea60fd Patch
https://github.com/discourse/discourse/commit/311b737c910cf0a69f61e1b8bc0b78374b6619d2 Patch
https://github.com/discourse/discourse/security/advisories/GHSA-cx83-5p6x-9qh9 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*
cpe:2.3:a:discourse:discourse:3.3.0:beta1:*:*:beta:*:*:*
cpe:2.3:a:discourse:discourse:3.3.0:beta2:*:*:beta:*:*:*
History

21 Nov 2024, 09:23

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 6.1 		v2 : unknown
v3 : 6.3
References () https://github.com/discourse/discourse/commit/26aef0c288839378b9de5819e96eac8cf4ea60fd - Patch () https://github.com/discourse/discourse/commit/26aef0c288839378b9de5819e96eac8cf4ea60fd - Patch
References () https://github.com/discourse/discourse/commit/311b737c910cf0a69f61e1b8bc0b78374b6619d2 - Patch () https://github.com/discourse/discourse/commit/311b737c910cf0a69f61e1b8bc0b78374b6619d2 - Patch
References () https://github.com/discourse/discourse/security/advisories/GHSA-cx83-5p6x-9qh9 - Vendor Advisory () https://github.com/discourse/discourse/security/advisories/GHSA-cx83-5p6x-9qh9 - Vendor Advisory

11 Sep 2024, 13:52

Type Values Removed Values Added
References () https://github.com/discourse/discourse/commit/26aef0c288839378b9de5819e96eac8cf4ea60fd - () https://github.com/discourse/discourse/commit/26aef0c288839378b9de5819e96eac8cf4ea60fd - Patch
References () https://github.com/discourse/discourse/commit/311b737c910cf0a69f61e1b8bc0b78374b6619d2 - () https://github.com/discourse/discourse/commit/311b737c910cf0a69f61e1b8bc0b78374b6619d2 - Patch
References () https://github.com/discourse/discourse/security/advisories/GHSA-cx83-5p6x-9qh9 - () https://github.com/discourse/discourse/security/advisories/GHSA-cx83-5p6x-9qh9 - Vendor Advisory
CVSS v2 : unknown
v3 : 6.3 		v2 : unknown
v3 : 6.1
CPE cpe:2.3:a:discourse:discourse:3.3.0:beta2:*:*:beta:*:*:*
cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*
cpe:2.3:a:discourse:discourse:3.3.0:beta1:*:*:beta:*:*:*
First Time Discourse
Discourse discourse

31 Jul 2024, 12:57

Type Values Removed Values Added
New CVE
Information

Published : 2024-07-30 15:15

Updated : 2024-11-21 09:23

NVD link : CVE-2024-37165

Mitre link : CVE-2024-37165

CVE.ORG link : CVE-2024-37165

JSON object : View

Products Affected

discourse

CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')