Products
Discourse
- < 3.2.5
- < 3.3.0.beta5
Source
security-advisories@github.com
Tags
CVE-2024-39320 details
Published : July 30, 2024, 3:15 p.m.
Last Modified : July 30, 2024, 3:15 p.m.
Last Modified : July 30, 2024, 3:15 p.m.
Description
Discourse is an open source discussion platform. Prior to 3.2.5 and 3.3.0.beta5, the vulnerability allows an attacker to inject iframes from any domain, bypassing the intended restrictions enforced by the allowed_iframes setting. This vulnerability is fixed in 3.2.5 and 3.3.0.beta5.
CVSS Score
| 1 | 2 | 3 | 4 | 5 | 6.1 | 7 | 8 | 9 | 10 |
|---|
Weakness
| Weakness | Name | Description |
|---|---|---|
| CWE-1021 | Improper Restriction of Rendered UI Layers or Frames | The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with. |
CVSS Data
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
Base Score
6.1
Exploitability Score
2.8
Impact Score
2.7
Base Severity
MEDIUM
Vector String : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
| URL | Source |
|---|---|
| https://github.com/discourse/discourse/commit/188cb58daa833839c54c266ce22db150a3f3a210 | security-advisories@github.com |
| https://github.com/discourse/discourse/commit/76f06f6b1491db6bd09a4017d2c5591431b3b16e | security-advisories@github.com |
| https://github.com/discourse/discourse/security/advisories/GHSA-4p82-xh38-gq4p | security-advisories@github.com |
This website uses the NVD API, but is not approved or certified by it.