Discourse vulnerable to Cross-site Scripting through tag descriptions
Summary
Discourse vulnerable to Cross-site Scripting through tag descriptions
Original description
The description as published by the source.
Discourse is an option source discussion platform. Prior to version 2.8.14 on the stable branch and version 3.0.0.beta16 on the beta and tests-passed branches, tag descriptions, which can be updated by moderators, can be used for cross-site scripting attacks. This vulnerability can lead to a full XSS on sites which have modified or disabled Discourse’s default Content Security Policy. Versions 2.8.14 and 3.0.0.beta16 contain a patch.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
References
- advisory github.com
- advisory github.com
- web nvd.nist.gov