Description

Discourse is an open source discussion platform. Prior to 3.2.3 and 3.3.0.beta3, improperly sanitized Onebox data could lead to an XSS vulnerability in some situations. This vulnerability only affects Discourse instances which have disabled the default Content Security Policy. This vulnerability is fixed in 3.2.3 and 3.3.0.beta3.

INFO

Published Date :

2024-07-30T14:10:24.804Z

Last Modified :

2024-08-02T03:50:55.188Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2024-37165 vulnerability.

Vendors Products
Discourse
  • Discourse
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2024-37165.

URL Resource
https://github.com/discourse/discourse/commit/26aef0c288839378b9de5819e96eac8cf4ea60fd cve-icon cve-icon cve-icon
https://github.com/discourse/discourse/commit/311b737c910cf0a69f61e1b8bc0b78374b6619d2 cve-icon cve-icon cve-icon
https://github.com/discourse/discourse/security/advisories/GHSA-cx83-5p6x-9qh9 cve-icon cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact