CVE-2024-39320

Katalog CVE

CVSS 6.1 · Medium EPSS 0,35%

Kerentanan Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') pada discourse. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

Discourse is an open source discussion platform. Prior to 3.2.5 and 3.3.0.beta5, the vulnerability allows an attacker to inject iframes from any domain, bypassing the intended restrictions enforced by the allowed_iframes setting. This vulnerability is fixed in 3.2.5 and 3.3.0.beta5.

Rincian

Terbit di NVD

30 Juli 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-1021: Improper Restriction of Rendered UI Layers or Frames

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 26,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/discourse/discourse/security/advisories/GHSA-4p82-xh38-gq4p advisory vendor
• https://github.com/discourse/discourse/commit/188cb58daa833839c54c266ce22db150a3f3a210 patch
• https://github.com/discourse/discourse/commit/76f06f6b1491db6bd09a4017d2c5591431b3b16e patch