Lucene search
GoogleOSV:BIT-2023-43659HistoryOct 20, 2023 - 6:17 a.m.
BIT-2023-43659
2023-10-2006:17:06
Google
osv.dev
20
discourse
community discussion
cross-site scripting
csp
patch
upgrade
0.0004 Low
EPSS
Percentile
14.1%
Discourse is an open source platform for community discussion. Improper escaping of user input allowed for Cross-site Scripting attacks via the digest email preview UI. This issue only affects sites with CSP disabled. This issue has been patched in the 3.1.1 stable release as well as the 3.2.0.beta1 release. Users are advised to upgrade. Users unable to upgrade should ensure CSP is enabled on the forum.
| CPE | Name | Operator | Version |
|---|---|---|---|
| discourse | lt | 3.1.1 | |
| discourse | ge | 3.2.0-beta1 | |
| discourse | le | 3.2.0-beta1 |
Related
prion
prion
Cross site scripting
2023-10-16 22:15:00
osv
osv
CVE-2023-43659
2023-10-16 22:15:12
BIT-discourse-2023-43659
2024-03-06 10:54:02
nvd
nvd
CVE-2023-43659
2023-10-16 22:15:12
cve
cve
CVE-2023-43659
2023-10-16 22:15:12
cvelist
cvelist
openvas
openvas
Discourse <= 3.1.1, 3.2.0.beta1 Multiple Vulnerabilities
2023-10-23 00:00:00