PT-2021-19913 · Discourse · Discourse

Davidtaylorhq · Published 2021-07-15 · Updated 2024-03-06 · CVE-2021-32764

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions 2.7.5 and prior

Description Discourse is an open-source discussion platform. The parsing and rendering of YouTube Oneboxes can be susceptible to XSS attacks in versions where the default Content Security Policy has been modified or disabled.

Recommendations For versions 2.7.5 and prior, update to stable version 2.7.6, beta version 2.8.0.beta3, or tests-passed version 2.8.0.beta3 to resolve the issue. As a temporary workaround, ensure that the Content Security Policy is enabled and has not been modified in a way that would make it more vulnerable to XSS attacks.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-DISCOURSE-2021-32764

CVE-2021-32764

GHSA-9X4C-29XG-56HW

Affected Products

Discourse

References · 6

• https://osv.dev/vulnerability/CVE-2021-32764 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32764 · Security Note
• https://osv.dev/vulnerability/BIT-discourse-2021-32764 · Vendor Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-9x4c-29xg-56hw · Note
• https://t.me/cibsecurity/26200 · Telegram Post
• https://t.me/cvenotify/17709 · Telegram Post