CVE-2021-32764: YouTube Onebox susceptible to XSS
Discourse is an open-source discussion platform. In Discourse versions 2.7.5 and prior, parsing and rendering of YouTube Oneboxes can be susceptible to XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse's default Content Security Policy. The issue is patched in stable version 2.7.6, beta version 2.8.0.beta3, and tests-passed version 2.8.0.beta3. As a workaround, ensure that the Content Security Policy is enabled, and has not been modified in a way which would make it more vulnerable to XSS attacks.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-32764?
CVE-2021-32764 is classified as a medium severity vulnerability due to its potential for XSS attacks.
How do I fix CVE-2021-32764?
To fix CVE-2021-32764, upgrade to Discourse version 2.8.0 or later, or ensure that the default Content Security Policy is enabled.
What versions are affected by CVE-2021-32764?
CVE-2021-32764 affects Discourse versions 2.7.5 and prior, as well as 2.8.0-beta1.
What types of attacks are possible with CVE-2021-32764?
CVE-2021-32764 can lead to XSS attacks, allowing an attacker to execute scripts in the context of a user's session.
Is my site vulnerable if I haven't modified the Content Security Policy for CVE-2021-32764?
Your site is not vulnerable to CVE-2021-32764 if you have not modified or disabled Discourse's default Content Security Policy.