CVE-2021-41095: XSS via blocked watched word in error message
Discourse is an open source discussion platform. There is a cross-site scripting (XSS) vulnerability in versions 2.7.7 and earlier of the stable branch, versions 2.8.0.beta6 and earlier of the beta branch, and versions 2.8.0.beta6 and earlier of the tests-passed branch. Rendering of some error messages that contain user input can be susceptible to XSS attacks. This vulnerability only affects sites which have blocked watched words that contain HTML tags, modified or disabled Discourse's default Content Security Policy. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. As a workaround, avoid modifying or disabling Discourse’s default Content Security Policy, and blocking watched words containing HTML tags.
Other sources
Discourse is an open source discussion platform. There is a cross-site scripting (XSS) vulnerability in versions 2.7.7 and earlier of the stable branch, versions 2.8.0.beta6 and earlier of the beta branch, and versions 2.8.0.beta6 and earlier of the tests-passed branch. Rendering of some error messages that contain user input can be susceptible to XSS attacks. This vulnerability only affects sites which have blocked watched words that contain HTML tags, modified or disabled Discourse's default Content Security Policy. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. As a workaround, avoid modifying or disabling Discourse’s default Content Security Policy, and blocking watched words containing HTML tags.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2.7.7 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2.8.0.beta6 - Compensating control
Mitigation/workaround: avoid modifying or disabling Discourse’s default Content Security Policy, and do not block watched words containing HTML tags.
Event History
Frequently Asked Questions
What is the severity of CVE-2021-41095?
CVE-2021-41095 is categorized as a cross-site scripting (XSS) vulnerability with a medium severity impact.
How do I fix CVE-2021-41095?
To fix CVE-2021-41095, upgrade Discourse to version 2.8.0 or later, ensuring you are not using a vulnerable version.
Which versions of Discourse are affected by CVE-2021-41095?
CVE-2021-41095 affects Discourse versions 2.7.7 and earlier of the stable branch, and versions 2.8.0.beta6 and earlier of the beta and tests-passed branches.
Can CVE-2021-41095 be exploited remotely?
Yes, CVE-2021-41095 can be exploited remotely, allowing attackers to execute scripts in the context of the user's session.
What are the consequences of not addressing CVE-2021-41095?
Failing to address CVE-2021-41095 may lead to user data exposure, session hijacking, and potential loss of user trust.