CVE-2022-36057

Discourse-Chat is an asynchronous messaging plugin for the Discourse open-source discussion platform. Users of Discourse Chat can be affected by admin users inserting HTML into chat titles and descriptions, causing a Cross-Site Scripting (XSS) attack. Version 0.9 contains a patch for this issue.

CVSS v3 4.8 MEDIUM

4.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.7 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/discourse/discourse-chat/pull/1205	Patch Third Party Advisory
https://github.com/discourse/discourse-chat/security/advisories/GHSA-3vf2-wrjx-p6xj	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:discourse:discourse-chat:*:*:*:*:*:discourse:*:*

History

No history.

Information

Published : 2022-09-06 20:15

Updated : 2024-02-28 19:29

NVD link : CVE-2022-36057

Mitre link : CVE-2022-36057

CVE.ORG link : CVE-2022-36057

JSON object : View

Products Affected

discourse

discourse-chat

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

{"id": "CVE-2022-36057", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.7}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2022-09-06T20:15:08.873", "references": [{"url": "https://github.com/discourse/discourse-chat/pull/1205", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/discourse/discourse-chat/security/advisories/GHSA-3vf2-wrjx-p6xj", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-80"}]}], "descriptions": [{"lang": "en", "value": "Discourse-Chat is an asynchronous messaging plugin for the Discourse open-source discussion platform. Users of Discourse Chat can be affected by admin users inserting HTML into chat titles and descriptions, causing a Cross-Site Scripting (XSS) attack. Version 0.9 contains a patch for this issue."}, {"lang": "es", "value": "Discourse-Chat es un plugin de mensajer\u00eda as\u00edncrona para la plataforma de debate de c\u00f3digo abierto Discourse. Los usuarios de Discourse Chat pueden verse afectados por usuarios administradores que insertan HTML en los t\u00edtulos y descripciones de los chats, causando un ataque de tipo Cross-Site Scripting (XSS). La versi\u00f3n 0.9 contiene un parche para este problema.\n"}], "lastModified": "2022-09-09T16:32:19.050", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:discourse:discourse-chat:*:*:*:*:*:discourse:*:*", "vulnerable": true, "matchCriteriaId": "A2BA9C99-E117-4FE3-A2A2-40CC2D9B19B0", "versionEndExcluding": "0.9"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}