CVE-2025-48954

Discourse is an open-source discussion platform. Versions prior to 3.5.0.beta6 are vulnerable to cross-site scripting when the content security policy isn't enabled when using social logins. Version 3.5.0.beta6 patches the issue. As a workaround, have the content security policy enabled.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/discourse/discourse/security/advisories/GHSA-26p5-mjjh-wfcf	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:discourse:discourse:::::beta:::*
	cpe:2.3:a:discourse:discourse:3.5.0:beta1:::beta:::*
	cpe:2.3:a:discourse:discourse:3.5.0:beta2:::beta:::*
	cpe:2.3:a:discourse:discourse:3.5.0:beta3:::beta:::*
	cpe:2.3:a:discourse:discourse:3.5.0:beta4:::beta:::*
	cpe:2.3:a:discourse:discourse:3.5.0:beta5:::beta:::*

History

No history.

Information

Published : 2025-06-25 14:15

Updated : 2025-09-25 20:27

NVD link : CVE-2025-48954

Mitre link : CVE-2025-48954

CVE.ORG link : CVE-2025-48954

JSON object : View

Products Affected

discourse

discourse

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-48954", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2025-06-25T14:15:24.777", "references": [{"url": "https://github.com/discourse/discourse/security/advisories/GHSA-26p5-mjjh-wfcf", "tags": ["Vendor Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Discourse is an open-source discussion platform. Versions prior to 3.5.0.beta6 are vulnerable to cross-site scripting when the content security policy isn't enabled when using social logins. Version 3.5.0.beta6 patches the issue. As a workaround, have the content security policy enabled."}, {"lang": "es", "value": "Discourse es una plataforma de discusi\u00f3n de c\u00f3digo abierto. Las versiones anteriores a la 3.5.0.beta6 son vulnerables a ataques de cross-site scripting cuando la pol\u00edtica de seguridad de contenido no est\u00e1 habilitada al usar inicios de sesi\u00f3n con redes sociales. La versi\u00f3n 3.5.0.beta6 soluciona el problema. Como soluci\u00f3n alternativa, active la pol\u00edtica de seguridad de contenido."}], "lastModified": "2025-09-25T20:27:53.497", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:beta:*:*:*", "vulnerable": true, "matchCriteriaId": "A0A6583A-A8AE-4C05-8947-79A0E4A73E1D", "versionEndExcluding": "3.5.0"}, {"criteria": "cpe:2.3:a:discourse:discourse:3.5.0:beta1:*:*:beta:*:*:*", "vulnerable": true, "matchCriteriaId": "66931995-F794-48F0-9DBB-9048B6C9D8DD"}, {"criteria": "cpe:2.3:a:discourse:discourse:3.5.0:beta2:*:*:beta:*:*:*", "vulnerable": true, "matchCriteriaId": "B0461B93-273C-4305-80F9-C70A100B4DFE"}, {"criteria": "cpe:2.3:a:discourse:discourse:3.5.0:beta3:*:*:beta:*:*:*", "vulnerable": true, "matchCriteriaId": "F1596D4E-FD8B-4443-AAAE-1D4AC6B1CE6D"}, {"criteria": "cpe:2.3:a:discourse:discourse:3.5.0:beta4:*:*:beta:*:*:*", "vulnerable": true, "matchCriteriaId": "997761D0-A8A1-438F-83DE-5E9E4890CEED"}, {"criteria": "cpe:2.3:a:discourse:discourse:3.5.0:beta5:*:*:beta:*:*:*", "vulnerable": true, "matchCriteriaId": "685B6537-929A-4DC9-8984-E114C5CB6E77"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}