CVE-2024-56328

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Discourse is an open source platform for community discussion. An attacker can execute arbitrary JavaScript on users' browsers by posting a maliciously crafted onebox url. This issue only affects sites with CSP disabled. This problem has been patched in the latest version of Discourse. Users are advised to upgrade. Users unable to upgrade should enable CSP, disable inline Oneboxes globally, or allow specific domains for Oneboxing.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
discourse	discourse	stable: <= 3.3.3; beta: <= 3.4.0.beta3; tests-passed: <= 3.4.0.beta3

References

https://github.com/discourse/discourse/security/advisories/GHSA-j855-mhxj-x6vgThird Party Advisory

Timeline

Published: Feb 4, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-563298.9Socialstream is a third-party package for Laravel Jetstream. It replaces the published authentication and profile scaffolding provided by La CVE-2024-56337.5Longse model LBH30FE200W cameras, as well as products based on this device, provide an unrestricted access for an attacker located in the sa CVE-2024-563309.3Stardust is a platform for streaming isolated desktop containers. With this exploit, inter container communication (ICC) is not disabled. Th CVE-2024-563316.8Uptime Kuma is an open source, self-hosted monitoring tool. An **Improper URL Handling Vulnerability** allows an attacker to access sensitiv CVE-2024-563325.3Next.js is a React framework for building full-stack web applications. Starting in version 13.0.0 and prior to versions 13.5.8, 14.2.21, and CVE-2024-563339.4Onyxia is a web app that aims at being the glue between multiple open source backend technologies to provide a state of art working environm CVE-2024-563347.8systeminformation is a System and OS information library for node.js. In affected versions SSIDs are not sanitized when before they are pass CVE-2024-563357.5vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. In affected versions an attacker i CVE-2024-563369.8A vulnerability has been identified in SINAMICS S200 (All versions with serial number beginning with SZVS8, SZVS9, SZVS0 or SZVSN and the FS CVE-2024-563379.8Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through CVE-2024-563384.8IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.3 is vulnerable to cross-site scripting. This CVE-2024-563397.5IBM WebSphere Application Server 9.0 and WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.7 could allow a remote attacker to byp