Vulnerability · Published Oct 16, 2023 · Assigned by GitHub_M

CVE-2023-43659Cross-site Scripting via email preview when CSP disabled in Discourse

High 8.0

In plain English

A high-severity cross-site scripting in discourse from discourse. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 3.1)8.0High

Exploit odds (30 days)0.5%top 58.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Discourse is an open source platform for community discussion. Improper escaping of user input allowed for Cross-site Scripting attacks via the digest email preview UI. This issue only affects sites with CSP disabled. This issue has been patched in the 3.1.1 stable release as well as the 3.2.0.beta1 release. Users are advised to upgrade. Users unable to upgrade should ensure CSP is enabled on the forum.

Affected products (as reported)

Vendor	Product	Versions
discourse	discourse	stable <= 3.1.1beta <= 3.2.0.beta1

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

References

https://github.com/discourse/discourse/security/advisories/GHSA-g4qg-5q2h-m8ph x_refsource_CONFIRM
https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP x_refsource_MISC