CVE-2022-39279mediumCWE-79

CVE-2022-39279: fallo de gravedad media en discourse-chat

Discourse-chat plugin susceptible to XSS in channel name and description

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear discourse-chat

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 4.3epss 0.5%
discourse-chat is a plugin for the Discourse message board which adds chat functionality. In versions prior to 0.9 some places render a chat channel's name and description in an unsafe way, allowing staff members to cause an cross site scripting (XSS) attack by inserting unsafe HTML into them. Version 0.9 has addressed this issue. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
Productos afectados
discourse · discourse-chat
CVEs relacionadas — discourse-chat

En el mismo producto, de las más peligrosas a las menos.

CVE-2022-31095MEDIUMExposure of Sensitive Information in discourse-chatEPSS 0.6%CVE-2022-36057MEDIUMDiscourse-Chat Cross-Site Scripting issue for channel names and descriptionsEPSS 0.5%