CVE-2024-35234 json
Discourse vulnerable to stored-dom XSS via Facebook Oneboxes
published 2024-07-03 2 y ago modified 2026-09-08 2 mo ago also BIT-discourse-2024-35234 , EUVD-2024-35251 , GHSA-5chg-hm8c-wc58
- cvss
- 4.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 26%
- public exploits
- 0
- none known
Summary
Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch, an attacker can execute arbitrary JavaScript on users’ browsers by posting a specific URL containing maliciously crafted meta tags. This issue only affects sites with Content Security Polic (CSP) disabled. The problem has been patched in version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch. As a workaround, ensure CSP is enabled on the forum.
Patch / fix
- bitnami discourse 3.2.3
- discourse discourse 3.2.3, 3.3.0.beta3
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.33% chance of exploitation in the next 30 days, higher than 26% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.2 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| OSV | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | discourse | <3.2.3 |
3.2.3 |
Affected products
- discourse discourse
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/discourse/discourse/commit/26aef0c288839378b9de5819e96eac8cf4ea60fd
patch
-
github.com
/discourse/discourse/commit/311b737c910cf0a69f61e1b8bc0b78374b6619d2
patch
-
github.com
/discourse/discourse/security/advisories/GHSA-5chg-hm8c-wc58
third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-35234
web
Sources
- CVE List CVE-2024-35234
- NVD CVE-2024-35234
- OSV BIT-discourse-2024-35234
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.