Vulnerability · Published Aug 9, 2021 · Assigned by GitHub_M

CVE-2021-37633XSS via d-popover and d-html-popover attribute

High 7.4

In plain English

A high-severity cross-site scripting in discourse from discourse. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 55% of all known vulnerabilities).

Severity (CVSS 3.1)7.4High

Exploit odds (30 days)0.8%top 44.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Discourse is an open source discussion platform. In versions prior to 2.7.8 rendering of d-popover tooltips can be susceptible to XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse's default Content Security Policy. This issue is patched in the latest `stable` 2.7.8 version of Discourse. As a workaround users may ensure that the Content Security Policy is enabled, and has not been modified in a way which would make it more vulnerable to XSS attacks.

Affected products (as reported)

Vendor	Product	Versions
discourse	discourse	< 2.7.8

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

References

https://github.com/discourse/discourse/security/advisories/GHSA-v3v8-3m5w-pjp9 x_refsource_CONFIRM
https://github.com/discourse/discourse/commit/38199424bc840d2ef002cd1e9bffdbb99191eb47 x_refsource_MISC