CVE-2023-43657 HIGH

CVE-2023-43657: Improper escaping of encrypted topic titles can lead to Cross-site Scripting under non-default site configuration

Vendor Discourse
Product discourse-encrypt
Weakness CWE-79 · XSS
Published September 28, 2023
Last update September 23, 2024
View on NVD All CVEs

CVSS base score

7.2/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

discourse-encrypt is a plugin that provides a secure communication channel through Discourse. Improper escaping of encrypted topic titles could lead to a cross site scripting (XSS) issue when a site has content security policy (CSP) headers disabled. Having CSP disabled is a non-default configuration, and having it disabled with discourse-encrypt installed will result in a warning in the Discourse admin dashboard. This has been fixed in commit `9c75810af9` which is included in the latest version of the discourse-encrypt plugin. Users are advised to upgrade. Users unable to upgrade should ensure that CSP headers are enabled and properly configured.

Key dates

02Disclosure timeline

September 28, 2023 CVE published
September 23, 2024 Record updated