Improper escaping of encrypted topic titles can lead to Cross-site Scripting under non-default site configuration

CVE-2023-43657

Summary

The discourse-encrypt plugin for Discourse has a defect related to improper escaping of encrypted topic titles. This issue can result in a cross site scripting (XSS) vulnerability when the site's Content Security Policy (CSP) headers are not enabled. Although this scenario occurs under a non-default condition, the presence of CSP headers is crucial for reducing risk. To address this vulnerability, users are encouraged to update the discourse-encrypt plugin to the latest version as indicated in commit 9c75810af9. For users unable to perform the update, enabling and appropriately configuring CSP headers is strongly recommended.

References