CVE-2023-43659

Published: Oct 16, 2023

Modified: Sep 16, 2024

PUBLISHED

CVSS v3.1

8.0

HIGH

Description

Discourse is an open source platform for community discussion. Improper escaping of user input allowed for Cross-site Scripting attacks via the digest email preview UI. This issue only affects sites with CSP disabled. This issue has been patched in the 3.1.1 stable release as well as the 3.2.0.beta1 release. Users are advised to upgrade. Users unable to upgrade should ensure CSP is enabled on the forum.

Vendor	Product	Versions
discourse	discourse	affected `stable <= 3.1.1` affected `beta <= 3.2.0.beta1`

Weaknesses (CWE)

CWE-79

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

References

https://github.com/discourse/discourse/security/advisories/GHSA-g4qg-5q2h-m8ph

x_refsource_CONFIRM

https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2023-43659

Description

Affected Products

Weaknesses (CWE)

CVSS v3.1 Details

References