PT-2023-20443 · Discourse · Discourse

Jomaxro · Published 2023-03-17 · Updated 2024-03-06 · CVE-2023-26040

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Discourse versions 3.1.0.beta2 through 3.1.0.beta3

Description Discourse is an open-source discussion platform. Editing or responding to a chat message containing malicious content could lead to a cross-site scripting attack.

Recommendations For versions 3.1.0.beta2, update to version 3.1.0.beta3 to resolve the issue. For version 3.1.0.beta3, no action is required as this version already includes the patch.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-DISCOURSE-2023-26040

CVE-2023-26040

GHSA-CCFC-QPMP-GQ87

Affected Products

Discourse

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26040.json · Exploit
• https://github.com/discourse/discourse/security/advisories/GHSA-ccfc-qpmp-gq87 · Vendor Advisory
• https://github.com/discourse/discourse/commit/a373bf2a01488c206e7feb28a9d2361b22ce6e70 · Patch
• https://osv.dev/vulnerability/CVE-2023-26040 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-discourse-2023-26040 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-26040 · Security Note
• https://t.me/cvenotify/46405 · Telegram Post