CVE-2024-23834: Discourse improperly sanitized user input leads to XSS
First published: Tue Jan 30 2024(Updated: )
Discourse is an open-source discussion platform. Improperly sanitized user input could lead to an XSS vulnerability in some situations. This vulnerability only affects Discourse instances which have disabled the default Content Security Policy. The vulnerability is patched in 3.1.5 and 3.2.0.beta5. As a workaround, ensure Content Security Policy is enabled and does not include `unsafe-inline`.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Discourse | <3.1.5 | |
| Discourse | <3.2.0 | |
| Discourse | =3.2.0-beta1 | |
| Discourse | =3.2.0-beta2 | |
| Discourse | =3.2.0-beta3 | |
| Discourse | =3.2.0-beta4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/discourse/discourse/security/advisories/GHSA-rj3g-8q6p-63pc
- https://github.com/discourse/discourse/commit/568d704a94c528b7c2cb0f3512a7b7b606bc3000
- https://meta.discourse.org/t/3-1-5-security-and-bug-fix-release/293094
- https://meta.discourse.org/t/3-2-0-beta5-add-groups-to-dms-mobile-chat-footer-redesign-passkeys-enabled-by-default-and-more/293093
Frequently Asked Questions
What is the severity of CVE-2024-23834?
CVE-2024-23834 is classified as a medium severity vulnerability due to its potential for XSS attacks.
How do I fix CVE-2024-23834?
To fix CVE-2024-23834, update your Discourse instance to version 3.1.5 or later, or ensure that your Content Security Policy is enabled.
Who is affected by CVE-2024-23834?
CVE-2024-23834 affects Discourse instances that have disabled the default Content Security Policy.
What type of vulnerability is CVE-2024-23834?
CVE-2024-23834 is an XSS vulnerability caused by improperly sanitized user input.
Which Discourse versions are vulnerable to CVE-2024-23834?
Discourse versions before 3.1.5, including specific beta versions up to 3.2.0, are vulnerable to CVE-2024-23834.
- agent/title
- agent/weakness
- agent/references
- agent/description
- agent/first-publish-date
- agent/type
- agent/author
- agent/event
- agent/severity
- agent/remedy
- agent/softwarecombine
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/discourse
- canonical/discourse
- version/discourse/3.2.0-beta1
- version/discourse/3.2.0-beta2
- version/discourse/3.2.0-beta3
- version/discourse/3.2.0-beta4