CVE-2023-22468: Discourse vulnerable to Cross-site Scripting in local oneboxes
Discourse is an open source platform for community discussion. Versions prior to 2.8.13 (stable), 3.0.0.beta16 (beta) and 3.0.0beta16 (tests-passed), are vulnerable to cross-site Scripting. A maliciously crafted URL can be included in a post to carry out cross-site scripting attacks on sites with disabled or overly permissive CSP (Content Security Policy). Discourse's default CSP prevents this vulnerability. This vulnerability is patched in versions 2.8.13 (stable), 3.0.0.beta16 (beta) and 3.0.0beta16 (tests-passed). As a workaround, enable and/or restore your site's CSP to the default one provided with Discourse.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-22468?
CVE-2023-22468 is a vulnerability in Discourse, an open source platform for community discussion, which allows cross-site scripting attacks.
How severe is CVE-2023-22468?
CVE-2023-22468 has a severity rating of high (5.4).
What software versions are affected by CVE-2023-22468?
Versions prior to 2.8.13 (stable), 3.0.0.beta16 (beta), and 3.0.0.beta16 (tests-passed) of Discourse are affected by CVE-2023-22468.
How can I fix CVE-2023-22468?
To fix CVE-2023-22468, you should update your Discourse installation to version 2.8.13 (stable), 3.0.0.beta16 (beta), or 3.0.0.beta16 (tests-passed) or later.
Where can I find more information about CVE-2023-22468?
You can find more information about CVE-2023-22468 in the official GitHub advisory: [link](https://github.com/discourse/discourse/security/advisories/GHSA-8mr2-xf8r-wr8m).