CVE-2017-20290: Discourse < 1.9.0.beta13 Reflected XSS via /email/unsubscribed
Discourse 1.9.0.beta2 before 1.9.0.beta13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the email parameter of /email/unsubscribed. Attackers can craft GET requests with SVG onload payloads, which unsubscribed.html.erb renders unescaped via htmlsafe, executing JavaScript in victims' browsers. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Discourse versions from 1.9.0.beta2 through versions before 1.9.0.beta13 are affected. Upgrading to 1.9.0.beta13 or later addresses the affected version range.
What does an attacker need to exploit this issue?
An attacker does not need to authenticate or hold privileges. They need to induce a victim to visit a crafted GET request to the affected endpoint containing a malicious email parameter.
What is the impact on a victim?
Malicious JavaScript can execute in the victim's browser because attacker-controlled content is rendered unescaped. The reported impact includes low confidentiality and integrity impact, with no availability impact.
Has exploitation been observed?
Yes. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.