{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-09-30T18:18:35.981","vulnerabilities":[{"cve":{"id":"CVE-2024-53266","sourceIdentifier":"security-advisories@github.com","published":"2025-02-04T22:15:40.347","lastModified":"2026-06-17T08:08:43.220","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Discourse is an open source platform for community discussion. In affected versions with some combinations of plugins, and with CSP disabled, activity streams in the user's profile page may be vulnerable to XSS. This has been patched in the latest version of Discourse core. Users are advised to upgrade. Users unable to upgrade should ensure CSP is enabled."},{"lang":"es","value":"Discourse es una plataforma de código abierto para debates comunitarios. En las versiones afectadas con algunas combinaciones de complementos y con CSP deshabilitado, los flujos de actividad en la página de perfil del usuario pueden ser vulnerables a XSS. Esto se ha corregido en la última versión del núcleo de Discourse. Se recomienda a los usuarios que actualicen la versión. Los usuarios que no puedan actualizar la versión deben asegurarse de que CSP esté habilitado."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"discourse","product":"discourse","versions":[{"version":"stable: < 3.3.3","status":"affected"},{"version":"tests-passed: < 3.4.0.beta4","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-02-04T21:40:15.684528Z","id":"CVE-2024-53266","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*","versionEndExcluding":"3.3.3","matchCriteriaId":"033D6E30-2A4D-43D4-9178-0BA5A7C501B0"},{"vulnerable":true,"criteria":"cpe:2.3:a:discourse:discourse:*:*:*:*:beta:*:*:*","versionEndExcluding":"3.4.0","matchCriteriaId":"B70F4653-EB23-49AB-AF71-C39E5B6D5E5F"},{"vulnerable":true,"criteria":"cpe:2.3:a:discourse:discourse:3.4.0:beta1:*:*:beta:*:*:*","matchCriteriaId":"AF6D8860-8764-4EEF-9FDD-89FF932791A7"},{"vulnerable":true,"criteria":"cpe:2.3:a:discourse:discourse:3.4.0:beta2:*:*:beta:*:*:*","matchCriteriaId":"6A7FC47A-8C19-4E39-B0CF-ADA835A02A9B"},{"vulnerable":true,"criteria":"cpe:2.3:a:discourse:discourse:3.4.0:beta3:*:*:beta:*:*:*","matchCriteriaId":"8802773F-8216-4F0F-9F58-89056BFBE8B8"}]}]}],"references":[{"url":"https://github.com/discourse/discourse/security/advisories/GHSA-hw4j-4hg7-22h2","source":"security-advisories@github.com","tags":["Third Party Advisory"]}]}}]}