PT-2024-32809
CVE-2024-47772
·
تاريخ النشر
2024-10-07
·
تاريخ التحديث
2025-09-25
الوصف من
CVSS 3.1
6.5
متوسطةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Name of the Vulnerable Software and Affected Versions
Discourse versions prior to the latest version
Description
An attacker can execute arbitrary JavaScript on users' browsers by sending a maliciously crafted chat message and replying to it. This issue only affects sites with Content Security Policy (CSP) disabled.
Recommendations
For versions prior to the latest version, upgrade to the latest version of Discourse.
As a temporary workaround for users unable to upgrade, ensure CSP is enabled on the forum.
Consider enabling a Content Security Policy (CSP) as a proactive measure after upgrading.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾