PT-2022-24865 · Discourse · Discourse-Chat

Nattsw · Published 2022-10-06 · Updated 2022-10-11 · CVE-2022-39279

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions discourse-chat versions prior to 0.9

Description The discourse-chat plugin for the Discourse message board has an issue where it renders a chat channel's name and description in an unsafe way, allowing staff members to cause a cross-site scripting (XSS) attack by inserting unsafe HTML into them.

Recommendations For versions prior to 0.9, upgrade to version 0.9 to address the issue. At the moment, there is no other information about additional mitigation measures for this issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-39279

GHSA-QP62-8M3C-9JGJ

Affected Products

Discourse-Chat

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39279.json · Exploit
• https://github.com/discourse/discourse-chat/commit/25737733af48e5b9fa60b0561d7fde14bea13cce · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-39279 · Security Note
• https://osv.dev/vulnerability/CVE-2022-39279 · Vendor Advisory
• https://github.com/discourse/discourse-chat/security/advisories/GHSA-qp62-8m3c-9jgj · Note
• https://t.me/cibsecurity/50935 · Telegram Post