PT-2024-28445 · Discourse · Discourse
CVSS v3.1
6.1
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Discourse versions prior to 3.2.5
Discourse versions prior to 3.3.0.beta5
Description
The issue allows an attacker to inject iframes from any domain, bypassing the intended restrictions enforced by the allowed iframes setting.
Recommendations
For versions prior to 3.2.5, update to version 3.2.5 or later.
For versions prior to 3.3.0.beta5, update to version 3.3.0.beta5 or later.
Exploit
Fix
DoS
Special Elements Injection
Clickjacking
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Discourse