VYPR
← All advisories
High severity7.5NVD Advisory· Published Jul 3, 2024· Updated Jun 17, 2026

CVE-2024-35227

CVE-2024-35227

Description

Discourse is an open-source discussion platform. Prior to version 3.2.3 on the stable branch and version 3.3.0.beta3 on the tests-passed branch, Oneboxing against a carefully crafted malicious URL can reduce the availability of a Discourse instance. The problem has been patched in version 3.2.3 on the stable branch and version 3.3.0.beta3 on the tests-passed branch. There are no known workarounds available for this vulnerability.

Affected products

4
  • Discourse (software)/Discourse3 versions
    cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*+ 2 more
    • cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*range: <=3.2.2
    • (no CPE)range: <3.2.3, <3.3.0.beta3
    • (no CPE)range: stable < 3.2.3
  • osv-coords
    pkg:bitnami/discourse
    Range: < 3.2.3

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.