CVE-2021-39161: Cross-site scripting via category name in Discourse
Discourse is an open source platform for community discussion. In affected versions category names can be used for Cross-site scripting(XSS) attacks. This is mitigated by Discourse's default Content Security Policy and this vulnerability only affects sites which have modified or disabled or changed Discourse's default Content Security Policy have allowed for moderators to modify categories. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. Users are advised to ensure that the Content Security Policy is enabled, and has not been modified in a way which would make it more vulnerable to XSS attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure Discourse’s default Content Security Policy is enabled and has not been modified/disabled/changed in a way that would make it more vulnerable to XSS attacks.
Discourse Content Security Policy (Content-Security-Policy) = enabled (not modified to be more permissive for XSS)
Event History
Frequently Asked Questions
What is the severity of CVE-2021-39161?
CVE-2021-39161 has a moderate severity level due to its potential for Cross-site scripting (XSS) attacks.
How do I fix CVE-2021-39161?
To fix CVE-2021-39161, ensure that your Discourse installation is updated to version 2.7.8 or later.
Which versions of Discourse are affected by CVE-2021-39161?
CVE-2021-39161 affects Discourse versions prior to 2.7.8 and specific beta versions of 2.8.0.
What is the attack vector for CVE-2021-39161?
The attack vector for CVE-2021-39161 involves using category names to execute Cross-site scripting (XSS) attacks on vulnerable systems.
Is there a default protection against CVE-2021-39161?
Yes, Discourse includes a default Content Security Policy that mitigates the impact of CVE-2021-39161 unless it has been modified or disabled.