VYPR
← All advisories
Medium severity6.3NVD Advisory· Published Jul 30, 2024· Updated Jun 17, 2026

CVE-2024-37165

CVE-2024-37165

Description

Discourse is an open source discussion platform. Prior to 3.2.3 and 3.3.0.beta3, improperly sanitized Onebox data could lead to an XSS vulnerability in some situations. This vulnerability only affects Discourse instances which have disabled the default Content Security Policy. This vulnerability is fixed in 3.2.3 and 3.3.0.beta3.

Affected products

6
  • Discourse (software)/Discourse5 versions
    cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*+ 4 more
    • cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*range: <3.2.3
    • cpe:2.3:a:discourse:discourse:3.3.0:beta1:*:*:beta:*:*:*
    • cpe:2.3:a:discourse:discourse:3.3.0:beta2:*:*:beta:*:*:*
    • (no CPE)range: <3.2.3, <3.3.0.beta3
    • (no CPE)range: < 3.2.3
  • osv-coords
    pkg:bitnami/discourse
    Range: < 3.2.3

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.