CVE-2023-25172

Published Mar 17, 2023

Last updated 2 years ago

Overview

Description: Discourse is an open-source discussion platform. Prior to version 3.0.1 of the `stable` branch and version 3.1.0.beta2 of the `beta` and `tests-passed` branches, a maliciously crafted URL can be included in a user's full name field to to carry out cross-site scripting attacks on sites with a disabled or overly permissive CSP (Content Security Policy). Discourse's default CSP prevents this vulnerability. The vulnerability is patched in version 3.0.1 of the `stable` branch and version 3.1.0.beta2 of the `beta` and `tests-passed` branches. As a workaround, enable and/or restore your site's CSP to the default one provided with Discourse.
Source: security-advisories@github.com
NVD status: Analyzed

Hype score: Not currently trending

Risk scores

CVSS 3.1

Type: Primary
Base score: 5.4
Impact score: 2.7
Exploitability score: 2.3
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Severity: MEDIUM

Weaknesses

security-advisories@github.com: CWE-79

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C19D7945-EB52-43C0-B9B7-8C250FEDC451",
            "versionEndExcluding": "3.0.1"
          },
          {
            "criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:beta:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D3C08972-822D-4657-9B6F-02BC692B7C6E",
            "versionEndExcluding": "3.1.0"
          },
          {
            "criteria": "cpe:2.3:a:discourse:discourse:3.1.0:beta1:*:*:beta:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B9BBED17-A6BA-4F17-8814-8D8521F28375"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 3.1

Weaknesses

Configurations

References