CVE-2022-39279CWE-79

Discourse-chat plugin susceptible to XSS in channel name and description

Medium · published October 6, 2022

CVSS v3.1
4.3
EPSS
0%
Percentile
40.6
In the wild
Unconfirmed
What it is

discourse-chat is a plugin for the Discourse message board which adds chat functionality. In versions prior to 0.9 some places render a chat channel's name and description in an unsafe way, allowing staff members to cause an cross site scripting (XSS) attack by inserting unsafe HTML into them. Version 0.9 has addressed this issue. Users are advised to upgrade. There are no known workarounds for this issue.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00482 · 40.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-10-06T00:00Z
EPSS history
Timeline
  • 06 OCT 00:00Z
    Discourse-chat plugin susceptible to XSS in channel name and description
    cvelistv5