Vulnerability · Published Nov 30, 2022 · Assigned by GitHub_M
CVE-2022-46162Discourse BBCode plugin vulnerable to arbitrary CSS injection
High 8.8
In plain English
A high-severity injection in discourse-bbcode from discourse. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities).
Official description
discourse-bbcode is the official BBCode plugin for Discourse. Prior to commit 91478f5, CSS injection can occur when rendering content generated with the discourse-bccode plugin. This vulnerability only affects sites which have the discourse-bbcode plugin installed and enabled. This issue is patched in commit 91478f5. As a workaround, ensure that the Content Security Policy is enabled and monitor any posts that contain bbcode.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| discourse | discourse-bbcode | < 91478f5cfecdcc43cf85b997168a8ecfd0f8df90 |
Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H