PT-2021-21748 · Discourse · Discourse

Bananabr · Published 2021-08-09 · Updated 2024-03-06 · CVE-2021-37633

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2.7.8

Description The issue affects Discourse, an open source discussion platform, where rendering of d-popover tooltips can be susceptible to XSS attacks in versions prior to 2.7.8. This vulnerability only affects sites that have modified or disabled Discourse's default Content Security Policy.

Recommendations For versions prior to 2.7.8, update to the latest stable version 2.7.8 to resolve the issue. As a temporary workaround, ensure that the Content Security Policy is enabled and has not been modified in a way that would make it more vulnerable to XSS attacks.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-DISCOURSE-2021-37633

CVE-2021-37633

GHSA-V3V8-3M5W-PJP9

Affected Products

Discourse

References · 7

• https://github.com/discourse/discourse/commit/38199424bc840d2ef002cd1e9bffdbb99191eb47 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-37633 · Security Note
• https://osv.dev/vulnerability/CVE-2021-37633 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-discourse-2021-37633 · Vendor Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-v3v8-3m5w-pjp9 · Note
• https://t.me/cvenotify/18929 · Telegram Post
• https://t.me/cibsecurity/27029 · Telegram Post