Discourse vulnerable to Cross-site Scripting through tag descriptions
概要
Discourse vulnerable to Cross-site Scripting through tag descriptions
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Discourse is an option source discussion platform. Prior to version 2.8.14 on the stable branch and version 3.0.0.beta16 on the beta and tests-passed branches, tag descriptions, which can be updated by moderators, can be used for cross-site scripting attacks. This vulnerability can lead to a full XSS on sites which have modified or disabled Discourse’s default Content Security Policy. Versions 2.8.14 and 3.0.0.beta16 contain a patch.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
参照URL
- advisory github.com
- advisory github.com
- web nvd.nist.gov