CVE-2023-43659

Discourse is an open source platform for community discussion. Improper escaping of user input allowed for Cross-site Scripting attacks via the digest email preview UI. This issue only affects sites with CSP disabled. This issue has been patched in the 3.1.1 stable release as well as the 3.2.0.beta1 release. Users are advised to upgrade. Users unable to upgrade should ensure CSP is enabled on the forum.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP	Third Party Advisory
https://github.com/discourse/discourse/security/advisories/GHSA-g4qg-5q2h-m8ph	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:discourse:discourse:::::stable:::*
	cpe:2.3:a:discourse:discourse:3.2.0:beta1:::beta:::*

History

19 Oct 2023, 17:56

Type	Values Removed	Values Added
References	~~(MISC) https://github.com/discourse/discourse/security/advisories/GHSA-g4qg-5q2h-m8ph -~~	(MISC) https://github.com/discourse/discourse/security/advisories/GHSA-g4qg-5q2h-m8ph - Vendor Advisory
References	~~(MISC) https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP -~~	(MISC) https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP - Third Party Advisory
CPE		cpe:2.3:a:discourse:discourse:3.2.0:beta1:::beta:::* cpe:2.3:a:discourse:discourse:::::stable:::*
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.4
First Time		Discourse Discourse discourse

16 Oct 2023, 22:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-10-16 22:15

Updated : 2024-02-28 20:33

NVD link : CVE-2023-43659

Mitre link : CVE-2023-43659

CVE.ORG link : CVE-2023-43659

JSON object : View

Products Affected

discourse

discourse

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2023-43659", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.0, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.1}]}, "published": "2023-10-16T22:15:12.237", "references": [{"url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/discourse/discourse/security/advisories/GHSA-g4qg-5q2h-m8ph", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Discourse is an open source platform for community discussion. Improper escaping of user input allowed for Cross-site Scripting attacks via the digest email preview UI. This issue only affects sites with CSP disabled. This issue has been patched in the 3.1.1 stable release as well as the 3.2.0.beta1 release. Users are advised to upgrade. Users unable to upgrade should ensure CSP is enabled on the forum.\n"}, {"lang": "es", "value": "Discourse es una plataforma de c\u00f3digo abierto para el debate comunitario. El escape inadecuado de la entrada del usuario permiti\u00f3 ataques de Cross-Site Scripting a trav\u00e9s de la interfaz de usuario de vista previa del resumen del correo electr\u00f3nico. Este problema s\u00f3lo afecta a sitios con CSP deshabilitado. Este problema se solucion\u00f3 en la versi\u00f3n 3.1.1 stable y en la versi\u00f3n 3.2.0.beta1. Se recomienda a los usuarios que actualicen. Los usuarios que no puedan actualizar deben asegurarse de que CSP est\u00e9 habilitado en el foro."}], "lastModified": "2023-10-19T17:56:26.263", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*", "vulnerable": true, "matchCriteriaId": "6AC25048-A9DA-4EB4-A05B-33B6348539CA", "versionEndIncluding": "3.1.1"}, {"criteria": "cpe:2.3:a:discourse:discourse:3.2.0:beta1:*:*:beta:*:*:*", "vulnerable": true, "matchCriteriaId": "1BFF647B-6CEF-43BF-BF5E-C82B557F78E2"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}