PT-2023-30322 · Discourse · Discourse

0Xmokusou + 1 · Publicado 2023-11-10 · Atualizado 2024-03-06 · CVE-2023-47119

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.1.3 Discourse version 3.2.0.beta3 and earlier of the beta and tests-passed branches

Description Discourse is an open source platform for community discussion. The issue allows some links to inject arbitrary HTML tags when rendered through the Onebox engine. There are no known workarounds.

Recommendations For versions prior to 3.1.3, update to version 3.1.3 or later of the stable branch. For version 3.2.0.beta3 and earlier of the beta and tests-passed branches, update to version 3.2.0.beta3 or later.

Exploit

Correção

Special Elements Injection

XSS

Enumeração de Fraquezas

CWE-74

CWE-79

Identificadores relacionados

BIT-DISCOURSE-2023-47119

CVE-2023-47119

GHSA-J95W-5HVX-JP5W

Produtos afetados

Discourse

Referências · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/47xxx/CVE-2023-47119.json · Exploit
• 🔥 https://github.com/BaadMaro/CVE-2023-47119 · Exploit
• https://github.com/discourse/discourse/commit/628b293ff53fb617b3464dd27268aec84388cc09 · Correção
• https://github.com/discourse/discourse/commit/d78357917c6a917a8a27af68756228e89c69321c · Correção
• https://github.com/discourse/discourse/security/advisories/GHSA-j95w-5hvx-jp5w · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1722996454212428090 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-47119 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-47119 · Nota de Segurança
• https://twitter.com/hack_git/status/1724405072124084254 · Publicação no Twitter
• https://osv.dev/vulnerability/BIT-discourse-2023-47119 · Aviso do Fabricante
• https://t.me/cybersecuritytechnologies/9394 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1723040023782519222 · Publicação no Twitter