[DISCOURSE] - 3.3.3: Security and maintenance release

[AWS]

Discourse 3.3.3 Stable Release

Discourse strongly recommends that all sites follow the default tests-passed branch of Discourse. The “stable” branch is more focused on lack of change than lack of bugs - all releases, including those on tests-passed and beta are production ready.

Security Updates

This release includes fixes for these security issues reported by our community and HackerOne.

• Bypass of Discourse Connect using other login paths if enabled (CVE-2024-49765)
• Moderators can view Screened emails even when the “moderators view emails” option is disabled (CVE-2024-52589)
• Magnific lightbox susceptible to XSS (CVE-2024-52794)
• Potential Backup file leaked via Nginx (CVE-2024-53991)

1 post - 1 participant

Read full topic