Описание
Discourse is an open source discussion platform. Prior to 3.2.5 and 3.3.0.beta5, the vulnerability allows an attacker to inject iframes from any domain, bypassing the intended restrictions enforced by the allowed_iframes setting. This vulnerability is fixed in 3.2.5 and 3.3.0.beta5.
Ссылки
- Patch
- Patch
- Vendor Advisory
- Patch
- Patch
- Vendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 3.2.5 (исключая)
Одно из
cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*
cpe:2.3:a:discourse:discourse:3.3.0:beta1:*:*:beta:*:*:*
cpe:2.3:a:discourse:discourse:3.3.0:beta2:*:*:beta:*:*:*
cpe:2.3:a:discourse:discourse:3.3.0:beta3:*:*:beta:*:*:*
cpe:2.3:a:discourse:discourse:3.3.0:beta4:*:*:beta:*:*:*
EPSS
Процентиль: 75%
0.0087
Низкий
6.1 Medium
CVSS3
Дефекты
CWE-74
CWE-1021
EPSS
Процентиль: 75%
0.0087
Низкий
6.1 Medium
CVSS3
Дефекты
CWE-74
CWE-1021