CVE-2023-43659CWE-79

Cross-site Scripting via email preview when CSP disabled in Discourse

High · published October 16, 2023

CVSS v3.1
8.0
EPSS
0%
Percentile
40.6
In the wild
Unconfirmed
What it is

Discourse is an open source platform for community discussion. Improper escaping of user input allowed for Cross-site Scripting attacks via the digest email preview UI. This issue only affects sites with CSP disabled. This issue has been patched in the 3.1.1 stable release as well as the 3.2.0.beta1 release. Users are advised to upgrade. Users unable to upgrade should ensure CSP is enabled on the forum.

The record
Technical detail
CVSS v3.1
8.0 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00482 · 40.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2023-10-16T21:05Z
EPSS history
Timeline
  • 16 OCT 21:05Z
    Cross-site Scripting via email preview when CSP disabled in Discourse
    cvelistv5