PT-2023-18519 · Discourse · Discourse

Gregxsunday + 1 · Publicado 2023-01-26 · Atualizado 2024-03-06 · CVE-2023-22468

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2.8.13 Discourse version 3.0.0.beta16 and earlier in the beta and tests-passed channels

Description The issue allows a maliciously crafted URL to be included in a post to carry out cross-site scripting attacks on sites with disabled or overly permissive Content Security Policy (CSP). Discourse's default CSP prevents this issue.

Recommendations For versions prior to 2.8.13, update to version 2.8.13 or later. For version 3.0.0.beta16 and earlier in the beta and tests-passed channels, update to version 3.0.0.beta16 or later. As a temporary workaround, enable and/or restore your site's CSP to the default one provided with Discourse.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BIT-DISCOURSE-2023-22468

CVE-2023-22468

GHSA-8MR2-XF8R-WR8M

Produtos afetados

Discourse

Referências · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22468.json · Exploit
• https://github.com/discourse/discourse/security/advisories/GHSA-8mr2-xf8r-wr8m · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-22468 · Nota de Segurança
• https://osv.dev/vulnerability/BIT-discourse-2023-22468 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-22468 · Aviso do Fabricante