Cross-site Scripting via email preview when CSP disabled in Discourse
CVE-2023-43659

8HIGH

Key Information:

Vendor
Discourse
Status
Discourse
Vendor
CVE Published:
16 October 2023

Summary

An improper escaping of user input within the digest email preview UI of the Discourse community platform poses a vulnerability that can be exploited for Cross-site Scripting (XSS) attacks. This issue specifically impacts installations where Content Security Policy (CSP) is disabled. To mitigate the risk, users are encouraged to upgrade to the patched versions, namely Discourse 3.1.1 or Discourse 3.2.0.beta1. For users unable to perform an upgrade, enabling CSP on forums is essential for enhancing security.

Affected Version(s)

discourse stable <= 3.1.1 <= stable 3.1.1

discourse beta <= 3.2.0.beta1 <= beta 3.2.0.beta1

References

https://github.com/discourse/discourse/security/advisorie...
x_refsource_CONFIRM
https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
x_refsource_MISC

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.