Discourse-chat plugin susceptible to XSS in channel name and description
CVE-2022-39279

4.3MEDIUM

Key Information:

Vendor

Discourse
Status
Discourse-chat
Vendor
CVE Published:
6 October 2022

What is CVE-2022-39279?

discourse-chat is a plugin for the Discourse message board which adds chat functionality. In versions prior to 0.9 some places render a chat channel's name and description in an unsafe way, allowing staff members to cause an cross site scripting (XSS) attack by inserting unsafe HTML into them. Version 0.9 has addressed this issue. Users are advised to upgrade. There are no known workarounds for this issue.

Affected Version(s)

discourse-chat < 0.9

References

https://github.com/discourse/discourse-chat/security/advi...
https://github.com/discourse/discourse-chat/commit/257377...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.