CVE-2024-35227

Published: Jul 3, 2024Modified: Aug 26, 2025

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch, Oneboxing against a carefully crafted malicious URL can reduce the availability of a Discourse instance. The problem has been patched in version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch. There are no known workarounds available for this vulnerability.

Affected (1)

Products: Discourse: Discourse

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Discourse Discourse	Up to 3.2.2

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (6)

https://github.com/discourse/discourse/commit/10afe5fcf1ebf2e49cb80716d5e62e184c53519b

Source: security-advisories@github.com

Patch

https://github.com/discourse/discourse/commit/6ce5673d2c1a511b602e1b2ade6cdc898d14ab36

Source: security-advisories@github.com

Patch

https://github.com/discourse/discourse/security/advisories/GHSA-664f-xwjw-752c

Source: security-advisories@github.com

Third Party Advisory

https://github.com/discourse/discourse/commit/10afe5fcf1ebf2e49cb80716d5e62e184c53519b

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/discourse/discourse/commit/6ce5673d2c1a511b602e1b2ade6cdc898d14ab36

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/discourse/discourse/security/advisories/GHSA-664f-xwjw-752c

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.