CVE-2024-35234

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch, an attacker can execute arbitrary JavaScript on users’ browsers by posting a specific URL containing maliciously crafted meta tags. This issue only affects sites with Content Security Polic (CSP) disabled. The problem has been patched in version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch. As a workaround, ensure CSP is enabled on the forum.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jul 3, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-352356.7OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.8 and earlier, when sta CVE-2024-352364.8Audiobookshelf is a self-hosted audiobook and podcast server. Prior to version 2.10.0, opening an ebook with malicious scripts inside leads CVE-2024-352377.5MIT IdentiBot is an open-source Discord bot written in Node.js that verifies individuals' affiliations with MIT, grants them roles in a Disc CVE-2024-352385.3Minder by Stacklok is an open source software supply chain security platform. Minder prior to version 0.0.51 is vulnerable to a denial-of-se CVE-2024-352395.4Umbraco Commerce is an open source dotnet web forms solution. In affected versions an authenticated user that has access to edit Forms may i CVE-2024-35245.4A vulnerability, which was classified as problematic, has been found in Campcodes Online Event Management System 1.0. This issue affects som CVE-2024-352405.4Umbraco Commerce is an open source dotnet ecommerce solution. In affected versions there exists a stored Cross-site scripting (XSS) issue wh CVE-2024-352418.8Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `status`, `reinstall` and `remove` comma CVE-2024-352428.8Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running insid CVE-2024-352449.1There are several hidden accounts. Some of them are intended for maintenance engineers, and with the knowledge of their passwords (e.g., by CVE-2024-352456.7Uncontrolled search path element in some Intel(R) PROSet/Wireless WiFi software for Windows before version 23.60 may allow an authenticated CVE-2024-352467.5An attacker may be able to cause a denial-of-service condition by sending many packets repeatedly.