CVE-2023-43657

Katalog CVE

CVSS 6.1 · Medium EPSS 0,59%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada discourse-encrypt. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

discourse-encrypt is a plugin that provides a secure communication channel through Discourse. Improper escaping of encrypted topic titles could lead to a cross site scripting (XSS) issue when a site has content security policy (CSP) headers disabled. Having CSP disabled is a non-default configuration, and having it disabled with discourse-encrypt installed will result in a warning in the Discourse admin dashboard. This has been fixed in commit `9c75810af9` which is included in the latest version of the discourse-encrypt plugin. Users are advised to upgrade. Users unable to upgrade should ensure that CSP headers are enabled and properly configured.

Rincian

Terbit di NVD

28 September 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,59% peluang dieksploitasi; lebih tinggi dari 46,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/discourse/discourse-encrypt/security/advisories/GHSA-5fh6-wp7p-xx7v advisory vendor
• https://github.com/discourse/discourse-encrypt/commit/9c75810af9a474d7edaec67dea66f852c0ba1f4e patch
• https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP product