What is the severity of CVE-2024-37165?

CVE-2024-37165 has been evaluated as a medium severity XSS vulnerability in Discourse.

How do I fix CVE-2024-37165?

To fix CVE-2024-37165, upgrade Discourse to version 3.2.3 or later, or to 3.3.0 beta 3 or later.

Who is affected by CVE-2024-37165?

CVE-2024-37165 affects Discourse instances that have disabled the default Content Security Policy.

What types of vulnerabilities are associated with CVE-2024-37165?

CVE-2024-37165 is associated with improperly sanitized Onebox data leading to potential cross-site scripting (XSS) vulnerabilities.

Is there a user impact for CVE-2024-37165?

Yes, if exploited, CVE-2024-37165 may allow an attacker to execute malicious scripts in the context of a user's browser.

Vulnerability/
CVE-2024-37165

medium

6.3

CWE

30/7/2024

11/9/2024

CVE-2024-37165: Discourse has an XSS via Onebox system

First published: Tue Jul 30 2024(Updated: )

Discourse is an open source discussion platform. Prior to 3.2.3 and 3.3.0.beta3, improperly sanitized Onebox data could lead to an XSS vulnerability in some situations. This vulnerability only affects Discourse instances which have disabled the default Content Security Policy. This vulnerability is fixed in 3.2.3 and 3.3.0.beta3.

Credit: security-advisories@github.com

Affected Software	Affected Version	How to fix
Discourse	<3.2.3
Discourse	=3.3.0-beta1
Discourse	=3.3.0-beta2

Remedy

https://github.com/discourse/discourse/commit/26aef0c288839378b9de5819e96eac8cf4ea60fd

Remedy

https://github.com/discourse/discourse/commit/311b737c910cf0a69f61e1b8bc0b78374b6619d2

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2024-37165?
CVE-2024-37165 has been evaluated as a medium severity XSS vulnerability in Discourse.
How do I fix CVE-2024-37165?
To fix CVE-2024-37165, upgrade Discourse to version 3.2.3 or later, or to 3.3.0 beta 3 or later.
Who is affected by CVE-2024-37165?
CVE-2024-37165 affects Discourse instances that have disabled the default Content Security Policy.
What types of vulnerabilities are associated with CVE-2024-37165?
CVE-2024-37165 is associated with improperly sanitized Onebox data leading to potential cross-site scripting (XSS) vulnerabilities.
Is there a user impact for CVE-2024-37165?
Yes, if exploited, CVE-2024-37165 may allow an attacker to execute malicious scripts in the context of a user's browser.

agent/weakness
agent/references
agent/title
agent/type
agent/first-publish-date
agent/description
agent/author
agent/event
collector/mitre-cve
source/MITRE
agent/remedy
agent/last-modified-date
agent/softwarecombine
agent/severity
agent/source
agent/tags
collector/nvd-api
source/NVD
agent/software-canonical-lookup
agent/software-canonical-lookup-request
vendor/discourse
canonical/discourse
version/discourse/3.3.0-beta1
version/discourse/3.3.0-beta2

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.