CVE-2025-48954

{"id": "CVE-2025-48954", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2025-06-25T14:15:24.777", "references": [{"url": "https://github.com/discourse/discourse/security/advisories/GHSA-26p5-mjjh-wfcf", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Discourse is an open-source discussion platform. Versions prior to 3.5.0.beta6 are vulnerable to cross-site scripting when the content security policy isn't enabled when using social logins. Version 3.5.0.beta6 patches the issue. As a workaround, have the content security policy enabled."}, {"lang": "es", "value": "Discourse es una plataforma de discusi\u00f3n de c\u00f3digo abierto. Las versiones anteriores a la 3.5.0.beta6 son vulnerables a ataques de cross-site scripting cuando la pol\u00edtica de seguridad de contenido no est\u00e1 habilitada al usar inicios de sesi\u00f3n con redes sociales. La versi\u00f3n 3.5.0.beta6 soluciona el problema. Como soluci\u00f3n alternativa, active la pol\u00edtica de seguridad de contenido."}], "lastModified": "2025-08-25T15:04:57.583", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:beta:*:*:*", "vulnerable": true, "matchCriteriaId": "A0A6583A-A8AE-4C05-8947-79A0E4A73E1D", "versionEndExcluding": "3.5.0"}, {"criteria": "cpe:2.3:a:discourse:discourse:3.5.0:-:*:*:beta:*:*:*", "vulnerable": true, "matchCriteriaId": "A930AF2E-758A-451E-A0A8-3777A922AA37"}, {"criteria": "cpe:2.3:a:discourse:discourse:3.5.0:beta1:*:*:beta:*:*:*", "vulnerable": true, "matchCriteriaId": "66931995-F794-48F0-9DBB-9048B6C9D8DD"}, {"criteria": "cpe:2.3:a:discourse:discourse:3.5.0:beta2:*:*:beta:*:*:*", "vulnerable": true, "matchCriteriaId": "B0461B93-273C-4305-80F9-C70A100B4DFE"}, {"criteria": "cpe:2.3:a:discourse:discourse:3.5.0:beta3:*:*:beta:*:*:*", "vulnerable": true, "matchCriteriaId": "F1596D4E-FD8B-4443-AAAE-1D4AC6B1CE6D"}, {"criteria": "cpe:2.3:a:discourse:discourse:3.5.0:beta4:*:*:beta:*:*:*", "vulnerable": true, "matchCriteriaId": "997761D0-A8A1-438F-83DE-5E9E4890CEED"}, {"criteria": "cpe:2.3:a:discourse:discourse:3.5.0:beta5:*:*:beta:*:*:*", "vulnerable": true, "matchCriteriaId": "685B6537-929A-4DC9-8984-E114C5CB6E77"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}