CVE-2022-46162: Discourse BBCode plugin vulnerable to arbitrary CSS injection
discourse-bbcode is the official BBCode plugin for Discourse. Prior to commit 91478f5, CSS injection can occur when rendering content generated with the discourse-bccode plugin. This vulnerability only affects sites which have the discourse-bbcode plugin installed and enabled. This issue is patched in commit 91478f5. As a workaround, ensure that the Content Security Policy is enabled and monitor any posts that contain bbcode.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-46162?
CVE-2022-46162 has a medium severity due to the potential for CSS injection.
How do I fix CVE-2022-46162?
To fix CVE-2022-46162, update the discourse-bbcode plugin to a version released after November 30, 2022.
Who is affected by CVE-2022-46162?
CVE-2022-46162 affects any Discourse installation that has the discourse-bbcode plugin installed and enabled.
What type of vulnerability is CVE-2022-46162?
CVE-2022-46162 is a CSS injection vulnerability that can be exploited through content generated by the discourse-bbcode plugin.
What can attackers do with CVE-2022-46162?
Attackers can exploit CVE-2022-46162 to inject malicious CSS into a page, potentially compromising the website's integrity.