Vulnerability Details CVE-2023-43657
discourse-encrypt is a plugin that provides a secure communication channel through Discourse. Improper escaping of encrypted topic titles could lead to a cross site scripting (XSS) issue when a site has content security policy (CSP) headers disabled. Having CSP disabled is a non-default configuration, and having it disabled with discourse-encrypt installed will result in a warning in the Discourse admin dashboard. This has been fixed in commit `9c75810af9` which is included in the latest version of the discourse-encrypt plugin. Users are advised to upgrade. Users unable to upgrade should ensure that CSP headers are enabled and properly configured.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 60.6%
CVSS Severity
CVSS v3 Score 7.2
References
- https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
- https://github.com/discourse/discourse-encrypt/commit/9c75810af9a474d7edaec67dea66f852c0ba1f4e
- https://github.com/discourse/discourse-encrypt/security/advisories/GHSA-5fh6-wp7p-xx7v
- https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
- https://github.com/discourse/discourse-encrypt/commit/9c75810af9a474d7edaec67dea66f852c0ba1f4e
- https://github.com/discourse/discourse-encrypt/security/advisories/GHSA-5fh6-wp7p-xx7v
Products affected by CVE-2023-43657
-
cpe:2.3:a:discourse:discourse-encrypt:-