« Volver al listado

CVE-2025-48954

Estado: AnalizadaMedia (6.1)—

Discourse is an open-source discussion platform. Versions prior to 3.5.0.beta6 are vulnerable to cross-site scripting when the content security policy isn't enabled when using social logins. Version 3.5.0.beta6 patches the issue. As a workaround, have the content security policy enabled.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Discourse — Discourse

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-48954",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-48954",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-06-25T14:18:06.577106Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "discourse",
          "product": "discourse",
          "versions": [
            {
              "status": "affected",
              "version": "< 3.5.0.beta6"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-06-25T14:15:24.777",
  "references": [
    {
      "url": "https://github.com/discourse/discourse/security/advisories/GHSA-26p5-mjjh-wfcf",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Discourse is an open-source discussion platform. Versions prior to 3.5.0.beta6 are vulnerable to cross-site scripting when the content security policy isn't enabled when using social logins. Version 3.5.0.beta6 patches the issue. As a workaround, have the content security policy enabled."
    },
    {
      "lang": "es",
      "value": "Discourse es una plataforma de discusión de código abierto. Las versiones anteriores a la 3.5.0.beta6 son vulnerables a ataques de cross-site scripting cuando la política de seguridad de contenido no está habilitada al usar inicios de sesión con redes sociales. La versión 3.5.0.beta6 soluciona el problema. Como solución alternativa, active la política de seguridad de contenido."
    }
  ],
  "lastModified": "2026-06-17T09:30:33.510",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:beta:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A0A6583A-A8AE-4C05-8947-79A0E4A73E1D",
              "versionEndExcluding": "3.5.0"
            },
            {
              "criteria": "cpe:2.3:a:discourse:discourse:3.5.0:beta1:*:*:beta:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "66931995-F794-48F0-9DBB-9048B6C9D8DD"
            },
            {
              "criteria": "cpe:2.3:a:discourse:discourse:3.5.0:beta2:*:*:beta:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B0461B93-273C-4305-80F9-C70A100B4DFE"
            },
            {
              "criteria": "cpe:2.3:a:discourse:discourse:3.5.0:beta3:*:*:beta:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F1596D4E-FD8B-4443-AAAE-1D4AC6B1CE6D"
            },
            {
              "criteria": "cpe:2.3:a:discourse:discourse:3.5.0:beta4:*:*:beta:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "997761D0-A8A1-438F-83DE-5E9E4890CEED"
            },
            {
              "criteria": "cpe:2.3:a:discourse:discourse:3.5.0:beta5:*:*:beta:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "685B6537-929A-4DC9-8984-E114C5CB6E77"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}