Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2024-35227 Details

Description

Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch, Oneboxing against a carefully crafted malicious URL can reduce the availability of a Discourse instance. The problem has been patched in version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch. There are no known workarounds available for this vulnerability.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: [email protected]CVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://github.com/discourse/discourse/commit/10afe5fcf1ebf2e49cb80716d5e62e184c53519b CVEPatch
https://github.com/discourse/discourse/commit/6ce5673d2c1a511b602e1b2ade6cdc898d14ab36 CVEPatch
https://github.com/discourse/discourse/security/advisories/GHSA-664f-xwjw-752c CVEThird Party Advisory
https://github.com/discourse/discourse/commit/10afe5fcf1ebf2e49cb80716d5e62e184c53519b [email protected]Patch
https://github.com/discourse/discourse/commit/6ce5673d2c1a511b602e1b2ade6cdc898d14ab36 [email protected]Patch

see all 6 references

Weakness Enumeration

CWE-IDCWE NameSource
CWE-20Improper Input Validation[email protected]

Affected Products

ProductVersions
discourse discourse
<= 3.2.2

CPE

  • cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*

Remediation

  • No remediation found in references.

Change History

5 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2024-35227
NVD Published Date:
Jul 3, 2024
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2024-35227 Details - Not Deferred