Vulnerabilities > CVE-2024-39320 - Improper Restriction of Rendered UI Layers or Frames vulnerability in Discourse

047910
CVSS 6.1 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
LOW
Integrity impact
LOW
Availability impact
NONE
network
low complexity
discourse
CWE-1021
NVD
Published: 2024-07-30
Updated: 2024-11-21

Summary

Discourse is an open source discussion platform. Prior to 3.2.5 and 3.3.0.beta5, the vulnerability allows an attacker to inject iframes from any domain, bypassing the intended restrictions enforced by the allowed_iframes setting. This vulnerability is fixed in 3.2.5 and 3.3.0.beta5.

Vulnerable Configurations

Part Description Count
Application
Discourse
245

Common Weakness Enumeration (CWE)

References