CVE-2023-43659

Cross-site Scripting via email preview when CSP disabled in Discourse

概要

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

Discourse is an open source platform for community discussion. Improper escaping of user input allowed for Cross-site Scripting attacks via the digest email preview UI. This issue only affects sites with CSP disabled. This issue has been patched in the 3.1.1 stable release as well as the 3.2.0.beta1 release. Users are advised to upgrade. Users unable to upgrade should ensure CSP is enabled on the forum.

出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

影響パッケージ

Bitnami discourse

[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"3.1.1"}]}]

参照URL

advisory developer.mozilla.org
advisory github.com
web nvd.nist.gov