CVE-2021-37633: XSS via d-popover and d-html-popover attribute
Discourse is an open source discussion platform. In versions prior to 2.7.8 rendering of d-popover tooltips can be susceptible to XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse's default Content Security Policy. This issue is patched in the latest stable 2.7.8 version of Discourse. As a workaround users may ensure that the Content Security Policy is enabled, and has not been modified in a way which would make it more vulnerable to XSS attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2.7.8 - Configuration
Ensure Discourse's default Content Security Policy is enabled and has not been modified in a way that would make it more vulnerable to XSS attacks (note: this vulnerability only affects sites that have modified or disabled the default CSP).
Discourse Content Security Policy (CSP) Content Security Policy enabled and unmodified from Discourse default = enabled (not modified/disabled)
Event History
Frequently Asked Questions
What is the severity of CVE-2021-37633?
CVE-2021-37633 is classified as a medium severity vulnerability due to the potential for XSS attacks.
How do I fix CVE-2021-37633?
To fix CVE-2021-37633, upgrade Discourse to version 2.7.8 or later.
Which versions of Discourse are affected by CVE-2021-37633?
CVE-2021-37633 affects Discourse versions prior to 2.7.8, including beta versions 2.8.0-beta2 and 2.8.0-beta3.
Can CVE-2021-37633 be exploited on all Discourse installations?
CVE-2021-37633 can be exploited only on Discourse sites that have modified or disabled the default Content Security Policy.
What type of attack is associated with CVE-2021-37633?
CVE-2021-37633 is associated with Cross-Site Scripting (XSS) attacks through the rendering of d-popover tooltips.