{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-47772", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-09-30T21:28:53.233Z", "datePublished": "2024-10-07T20:50:33.324Z", "dateUpdated": "2024-10-08T14:26:22.147Z"}, "containers": {"cna": {"title": "Cross-site Scripting (XSS) via chat excerpts when content security policy (CSP) disabled in Discourse", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/discourse/discourse/security/advisories/GHSA-67mh-xhmf-c56h", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/discourse/discourse/security/advisories/GHSA-67mh-xhmf-c56h"}, {"name": "https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP", "tags": ["x_refsource_MISC"], "url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"}], "affected": [{"vendor": "discourse", "product": "discourse", "versions": [{"version": "stable: < 3.3.2", "status": "affected"}, {"version": "tests-passed: < 3.4.0.beta2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-10-07T20:50:33.324Z"}, "descriptions": [{"lang": "en", "value": "Discourse is an open source platform for community discussion. An attacker can execute arbitrary JavaScript on users' browsers by sending a maliciously crafted chat message and replying to it. This issue only affects sites with CSP disabled. This problem is patched in the latest version of Discourse. All users are advised to upgrade. Users unable to upgrade should ensure CSP is enabled on the forum. Users who do upgrade should also consider enabling a CSP as well as a proactive measure."}], "source": {"advisory": "GHSA-67mh-xhmf-c56h", "discovery": "UNKNOWN"}}, "adp": [{"affected": [{"vendor": "discourse", "product": "discourse", "cpes": ["cpe:2.3:a:discourse:discourse:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "3.3.2", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "3.4.0_beta2", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-08T14:23:25.185548Z", "id": "CVE-2024-47772", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-08T14:26:22.147Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-47772", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-08T14:23:25.185548Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:discourse:discourse:-:*:*:*:*:*:*:*"], "vendor": "discourse", "product": "discourse", "versions": [{"status": "affected", "version": "0", "lessThan": "3.3.2", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "3.4.0_beta2", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-08T14:25:44.107Z"}}], "cna": {"title": "Cross-site Scripting (XSS) via chat excerpts when content security policy (CSP) disabled in Discourse", "source": {"advisory": "GHSA-67mh-xhmf-c56h", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "discourse", "product": "discourse", "versions": [{"status": "affected", "version": "stable: < 3.3.2"}, {"status": "affected", "version": "tests-passed: < 3.4.0.beta2"}]}], "references": [{"url": "https://github.com/discourse/discourse/security/advisories/GHSA-67mh-xhmf-c56h", "name": "https://github.com/discourse/discourse/security/advisories/GHSA-67mh-xhmf-c56h", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP", "name": "https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Discourse is an open source platform for community discussion. An attacker can execute arbitrary JavaScript on users' browsers by sending a maliciously crafted chat message and replying to it. This issue only affects sites with CSP disabled. This problem is patched in the latest version of Discourse. All users are advised to upgrade. Users unable to upgrade should ensure CSP is enabled on the forum. Users who do upgrade should also consider enabling a CSP as well as a proactive measure."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-10-07T20:50:33.324Z"}}}, "cveMetadata": {"cveId": "CVE-2024-47772", "state": "PUBLISHED", "dateUpdated": "2024-10-08T14:26:22.147Z", "dateReserved": "2024-09-30T21:28:53.233Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-10-07T20:50:33.324Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*", "matchCriteriaId": "16A670AB-8B0F-4866-9592-0B463C93175C", "versionEndExcluding": "3.3.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:beta:*:*:*", "matchCriteriaId": "B70F4653-EB23-49AB-AF71-C39E5B6D5E5F", "versionEndExcluding": "3.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:discourse:discourse:3.4.0:-:*:*:beta:*:*:*", "matchCriteriaId": "BAB3A427-361B-4FC1-859D-D871B080DEE8", "vulnerable": true}, {"criteria": "cpe:2.3:a:discourse:discourse:3.4.0:beta1:*:*:beta:*:*:*", "matchCriteriaId": "AF6D8860-8764-4EEF-9FDD-89FF932791A7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Discourse is an open source platform for community discussion. An attacker can execute arbitrary JavaScript on users' browsers by sending a maliciously crafted chat message and replying to it. This issue only affects sites with CSP disabled. This problem is patched in the latest version of Discourse. All users are advised to upgrade. Users unable to upgrade should ensure CSP is enabled on the forum. Users who do upgrade should also consider enabling a CSP as well as a proactive measure."}, {"lang": "es", "value": "Discourse es una plataforma de c\u00f3digo abierto para debates comunitarios. Un atacante puede ejecutar c\u00f3digo JavaScript arbitrario en los navegadores de los usuarios enviando un mensaje de chat manipulado con fines malintencionados y respondi\u00e9ndolo. Este problema solo afecta a los sitios que tienen el CSP deshabilitado. Este problema est\u00e1 corregido en la \u00faltima versi\u00f3n de Discourse. Se recomienda a todos los usuarios que actualicen la versi\u00f3n. Los usuarios que no puedan actualizar la versi\u00f3n deben asegurarse de que el CSP est\u00e9 habilitado en el foro. Los usuarios que actualicen la versi\u00f3n tambi\u00e9n deben considerar habilitar un CSP, as\u00ed como una medida proactiva."}], "id": "CVE-2024-47772", "lastModified": "2024-10-19T00:58:21.947", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2024-10-07T21:15:18.383", "references": [{"source": "security-advisories@github.com", "tags": ["Mitigation", "Third Party Advisory"], "url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/discourse/discourse/security/advisories/GHSA-67mh-xhmf-c56h"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}