CVE-2024-39320: Discourse allows iframe injection though default site setting
First published: Tue Jul 30 2024(Updated: )
Discourse is an open source discussion platform. Prior to 3.2.5 and 3.3.0.beta5, the vulnerability allows an attacker to inject iframes from any domain, bypassing the intended restrictions enforced by the allowed_iframes setting. This vulnerability is fixed in 3.2.5 and 3.3.0.beta5.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Discourse | <3.2.5 | |
| Discourse | =3.3.0-beta1 | |
| Discourse | =3.3.0-beta2 | |
| Discourse | =3.3.0-beta3 | |
| Discourse | =3.3.0-beta4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-39320?
CVE-2024-39320 is considered a moderate severity vulnerability that allows iframe injection from any domain.
How do I fix CVE-2024-39320?
To fix CVE-2024-39320, upgrade to Discourse versions 3.2.5 or 3.3.0.beta5 or later.
What software is affected by CVE-2024-39320?
CVE-2024-39320 affects Discourse versions prior to 3.2.5 and all 3.3.0 beta versions up to beta4.
What impact does CVE-2024-39320 have on security?
CVE-2024-39320 can lead to security risks such as cross-site scripting (XSS) due to untrusted iframe content.
Is there a workaround for CVE-2024-39320?
There is no official workaround for CVE-2024-39320 apart from updating to the fixed versions.
- agent/weakness
- agent/title
- agent/references
- agent/description
- agent/first-publish-date
- agent/type
- agent/severity
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/discourse
- canonical/discourse
- version/discourse/3.3.0-beta1
- version/discourse/3.3.0-beta2
- version/discourse/3.3.0-beta3
- version/discourse/3.3.0-beta4