CVE-2023-43657highCWE-79

CVE-2023-43657: falha de alta gravidade em discourse-encrypt

Improper escaping of encrypted topic titles can lead to Cross-site Scripting under non-default site configuration

Publicada em 28 set 2023 · Atualizada em 23 set 2024

Seguir esta CVE + Monitorar discourse-encrypt

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.2epss 0.6%

discourse-encrypt is a plugin that provides a secure communication channel through Discourse. Improper escaping of encrypted topic titles could lead to a cross site scripting (XSS) issue when a site has content security policy (CSP) headers disabled. Having CSP disabled is a non-default configuration, and having it disabled with discourse-encrypt installed will result in a warning in the Discourse admin dashboard. This has been fixed in commit `9c75810af9` which is included in the latest version of the discourse-encrypt plugin. Users are advised to upgrade. Users unable to upgrade should ensure that CSP headers are enabled and properly configured.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Produtos afetados

discourse · discourse-encrypt

Referências

https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP https://github.com/discourse/discourse-encrypt/commit/9c75810af9a474d7edaec67dea66f852c0ba1f4e https://github.com/discourse/discourse-encrypt/security/advisories/GHSA-5fh6-wp7p-xx7v