CVE-2024-39320CWE-1021CWE-74

Discourse allows iframe injection though default site setting

Medium · published July 30, 2024

CVSS v3.1
6.1
EPSS
0%
Percentile
26.8
In the wild
Unconfirmed
What it is

Discourse is an open source discussion platform. Prior to 3.2.5 and 3.3.0.beta5, the vulnerability allows an attacker to inject iframes from any domain, bypassing the intended restrictions enforced by the allowed_iframes setting. This vulnerability is fixed in 3.2.5 and 3.3.0.beta5.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00345 · 26.8th percentile
Weaknesses
CWE-1021 · Improper Restriction of Rendered UI Layers or Frames; CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Published
2024-07-30T14:33Z
EPSS history
Timeline
  • 30 JUL 14:33Z
    Discourse allows iframe injection though default site setting
    cvelistv5