« Volver al listado

CVE-2025-24972

Estado: AnalizadaMedia (4.3)—

Discourse is an open-source discussion platform. Prior to versions `3.3.4` on the `stable` branch and `3.4.0.beta5` on the `beta` branch, in specific circumstances, users could be added to group direct messages despite disabling direct messaging in their preferences. Versions `3.3.4` and `3.4.0.beta5` contain a patch for the issue. A workaround is available. If a user disables chat in their preferences then they cannot be added to new group chats.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Discourse — Discourse

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-24972",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-24972",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-03-26T18:25:32.740494Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "discourse",
          "product": "discourse",
          "versions": [
            {
              "status": "affected",
              "version": "< 3.3.4"
            },
            {
              "status": "affected",
              "version": ">= 3.4.0.beta1, < 3.4.0.beta5"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-03-26T15:16:07.920",
  "references": [
    {
      "url": "https://github.com/discourse/discourse/security/advisories/GHSA-4p63-qw6g-4mv2",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Discourse is an open-source discussion platform. Prior to versions `3.3.4` on the `stable` branch and `3.4.0.beta5` on the `beta` branch, in specific circumstances, users could be added to group direct messages despite disabling direct messaging in their preferences. Versions `3.3.4` and `3.4.0.beta5` contain a patch for the issue. A workaround is available. If a user disables chat in their preferences then they cannot be added to new group chats."
    },
    {
      "lang": "es",
      "value": "Discourse es una plataforma de discusión de código abierto. Antes de las versiones 3.3.4 de la rama estable y 3.4.0.beta5 de la rama beta, en circunstancias específicas, se podía añadir usuarios a mensajes directos de grupo a pesar de tener la opción deshabilitada en sus preferencias. Las versiones 3.3.4 y 3.4.0.beta5 incluyen un parche para este problema. Existe un workaround. Si un usuario deshabilita el chat en sus preferencias, no podrá añadirse a nuevos chats de grupo."
    }
  ],
  "lastModified": "2026-06-17T08:59:54.450",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "07E7B04F-B033-48BB-AA28-8C38BE2D7334",
              "versionEndExcluding": "3.3.4"
            },
            {
              "criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:beta:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B70F4653-EB23-49AB-AF71-C39E5B6D5E5F",
              "versionEndExcluding": "3.4.0"
            },
            {
              "criteria": "cpe:2.3:a:discourse:discourse:3.4.0:beta1:*:*:beta:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AF6D8860-8764-4EEF-9FDD-89FF932791A7"
            },
            {
              "criteria": "cpe:2.3:a:discourse:discourse:3.4.0:beta2:*:*:beta:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6A7FC47A-8C19-4E39-B0CF-ADA835A02A9B"
            },
            {
              "criteria": "cpe:2.3:a:discourse:discourse:3.4.0:beta3:*:*:beta:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8802773F-8216-4F0F-9F58-89056BFBE8B8"
            },
            {
              "criteria": "cpe:2.3:a:discourse:discourse:3.4.0:beta4:*:*:beta:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C6414144-DB59-412A-96A2-4405A25356A8"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}