PT-2023-20443 · Discourse · Discourse

Jomaxro · CVE-2023-26040 · Publicado 2023-03-17 · Atualizado 2024-03-06

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Discourse versions 3.1.0.beta2 through 3.1.0.beta3

Description Discourse is an open-source discussion platform. Editing or responding to a chat message containing malicious content could lead to a cross-site scripting attack.

Recommendations For versions 3.1.0.beta2, update to version 3.1.0.beta3 to resolve the issue. For version 3.1.0.beta3, no action is required as this version already includes the patch.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BIT-DISCOURSE-2023-26040

CVE-2023-26040

GHSA-CCFC-QPMP-GQ87

Produtos afetados

Discourse

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26040.json · Exploit
• https://github.com/discourse/discourse/security/advisories/GHSA-ccfc-qpmp-gq87 · Aviso do Fabricante
• https://github.com/discourse/discourse/commit/a373bf2a01488c206e7feb28a9d2361b22ce6e70 · Correção
• https://osv.dev/vulnerability/CVE-2023-26040 · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-discourse-2023-26040 · Aviso do Fabricante
• https://t.me/cvenotify/46405 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-26040 · Nota de Segurança