NetSight
IP …
medium4.2

CVE-2024-35234

Discourse is an open-source discussion platform.

Impact

Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch, an attacker can execute arbitrary JavaScript on users’ browsers by posting a specific URL containing maliciously crafted meta tags. This issue only affects sites with Content Security Polic (CSP) disabled. The problem has been patched in version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch. As a workaround, ensure CSP is enabled on the forum.

Affected products

VendorProductAffected versions
DiscourseDiscourse
before 3.2.3
before 3.3.0
Version 3.3.0

Weakness classification

CWE-79

References