PT-2021-23959 · Unknown · Discourse-Footnote

Jomaxro · Published 2021-12-14 · Updated 2021-12-29 · CVE-2021-43827

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions: discourse-footnote versions prior to 0.2

Description: The discourse-footnote library has an issue where posting an inline footnote wrapped in <a> tags results in a nested <a> in the rendered HTML, which is stripped by Nokogiri due to its invalidity. This causes a javascript error on topic pages because the code looks for an <a> element inside the footnote reference span to get its ID, but since it does not exist, a null reference error occurs in javascript.

Recommendations: For versions prior to 0.2, update to version 0.2 to resolve the issue. As a temporary workaround, consider editing offending posts from the rails console or the database console for self-hosters, or disabling the plugin in the admin panel to mitigate this issue.

Fix

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

CVE-2021-43827

GHSA-58VR-C56V-QR57

Affected Products

Discourse-Footnote

References · 5

• https://github.com/discourse/discourse-footnote/commit/796617e0131277011207541313522cd1946661ab · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-43827 · Security Note
• https://osv.dev/vulnerability/CVE-2021-43827 · Vendor Advisory
• https://github.com/discourse/discourse-footnote/security/advisories/GHSA-58vr-c56v-qr57 · Note
• https://t.me/cibsecurity/33993 · Telegram Post