CVE-2023-30538

Katalog CVE

CVSS 5.4 · Medium EPSS 0,36%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada discourse. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

Discourse is an open source platform for community discussion. Due to the improper sanitization of SVG files, an attacker can execute arbitrary JavaScript on the users’ browsers by uploading a crafted SVG file. This issue is patched in the latest stable and tests-passed versions of Discourse. Users are advised to upgrade. For users unable to upgrade there are two possible workarounds: enable CDN handing of uploads (and ensure the CDN sanitizes SVG files) or disable SVG file uploads by ensuring that the `authorized extensions` site setting does not include `svg` (or reset that setting to the default, by default Discourse doesn't enable SVG uploads by users).

Rincian

Terbit di NVD

18 April 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 28,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/discourse/discourse/security/advisories/GHSA-w5mv-4pjf-xj43 mitigasi · advisory pihak ketiga