CVE-2024-43408CWE-79

Discourse Placeholder Forms has a XSS stopped by CSP

Medium · published August 20, 2024

CVSS v3.1
6.3
EPSS
0%
Percentile
16.1
In the wild
Unconfirmed
What it is

Discourse Placeholder Forms will let you build dynamic documentation. Unsanitized and stored user input was injected in the html of the post. The vulnerability is fixed in commit a62f711d5600e4e5d86f342d52932cb6221672e7.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00255 · 16.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-08-20T16:28Z
EPSS history
Timeline
  • 20 AUG 16:28Z
    Discourse Placeholder Forms has a XSS stopped by CSP
    cvelistv5