CVE-2023-22455
Severity CVSS v4.0:
Pending analysis
Type:
CWE-79
Cross-Site Scripting (XSS)
Publication date:
05/01/2023
Last modified:
11/01/2023
Description
Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 3.0.0.beta16 on the `beta` and `tests-passed` branches, tag descriptions, which can be updated by moderators, can be used for cross-site scripting attacks. This vulnerability can lead to a full XSS on sites which have modified or disabled Discourse’s default Content Security Policy. Versions 2.8.14 and 3.0.0.beta16 contain a patch.
Impact
Base Score 3.x
6.10
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:* | 2.8.14 (excluding) | |
| cpe:2.3:a:discourse:discourse:1.1.0:beta1:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.1.0:beta2:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.1.0:beta3:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.1.0:beta4:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.1.0:beta5:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.1.0:beta6:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.1.0:beta6b:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.1.0:beta7:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.1.0:beta8:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.2.0:beta1:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.2.0:beta2:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.2.0:beta3:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.2.0:beta4:*:*:beta:*:*:* | ||
| cpe:2.3:a:discourse:discourse:1.2.0:beta5:*:*:beta:*:*:* |
To consult the complete list of CPE names with products and versions, see this page