CVE-2024-47772

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Discourse is an open source platform for community discussion. An attacker can execute arbitrary JavaScript on users' browsers by sending a maliciously crafted chat message and replying to it. This issue only affects sites with CSP disabled. This problem is patched in the latest version of Discourse. All users are advised to upgrade. Users unable to upgrade should ensure CSP is enabled on the forum. Users who do upgrade should also consider enabling a CSP as well as a proactive measure.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Oct 7, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-477738.2Discourse is an open source platform for community discussion. An attacker can make several XHR requests until the cache is poisoned with a CVE-2024-477749.1GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been identified in the gst_avi_su CVE-2024-477759.1GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been found in the parse_ds64 func CVE-2024-477769.1GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been discovered in gst_wavparse_cue_chunk withi CVE-2024-477779.1GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been identified in the gst_wavpar CVE-2024-477787.5GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been discovered in gst_wavparse_a CVE-2024-477797.0Element is a Matrix web client built using the Matrix React SDK. Element Web versions 1.11.70 through 1.11.80 contain a vulnerability which CVE-2024-47789.8Memory safety bugs present in Firefox 125. Some of these bugs showed evidence of memory corruption and we presume that with enough effort so CVE-2024-477804.3TYPO3 is a free and open source Content Management Framework. Backend users could see items in the backend page tree without having access i CVE-2024-477816.1CreateWiki is an extension used at Miraheze for requesting & creating wikis. The name of requested wikis is not escaped on Special:RequestWi CVE-2024-477825.4WikiDiscover is an extension designed for use with a CreateWiki managed farm to display wikis. Special:WikiDiscover is a special page that l CVE-2024-477837.8A vulnerability has been identified in SIPORT (All versions < V3.4.0). The affected application improperly assigns file permissions to insta