CVE-2024-39320

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-39320

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-39320.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2024-39320

Aliases

BIT-discourse-2024-39320
GHSA-4p82-xh38-gq4p

Published

2024-07-30T14:33:48.589Z

Modified

2026-05-18T05:56:06.297741103Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Discourse allows iframe injection though default site setting

Details

Discourse is an open source discussion platform. Prior to 3.2.5 and 3.3.0.beta5, the vulnerability allows an attacker to inject iframes from any domain, bypassing the intended restrictions enforced by the allowed_iframes setting. This vulnerability is fixed in 3.2.5 and 3.3.0.beta5.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39320.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-1021",
        "CWE-74"
    ]
}

References

Affected packages

Git / github.com/discourse/discourse

Affected ranges

Type: GIT
Repo: https://github.com/discourse/discourse
Events: Introduced

ad7e3e04f335fd934d77106b5691decd6c31dbce

Fixed

f4cbf025b5ed6cd5327f96105f1ebf37e7854456

Affected versions

v3.*

v3.3.0.beta1

v3.3.0.beta2

v3.3.0.beta3

v3.3.0.beta4

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-39320.json"