CVE-2023-29196: XSS
First published: Tue Apr 18 2023(Updated: )
Discourse is an open source platform for community discussion. This vulnerability is not exploitable on the default install of Discourse. A custom feature must be enabled for it to work at all, and the attacker’s payload must pass the CSP to be executed. However, if an attacker succeeds in embedding Javascript that does pass the CSP, it could result in session hijacking for any users that view the attacker’s post. The vulnerability is patched in the latest tests-passed, beta and stable branches. Users are advised to upgrade. Users unable to upgrade should enable and/or restore your site's CSP to the default one provided with Discourse. Remove any embed-able hosts configured.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Discourse Discourse | <3.0.3 | |
| Discourse Discourse | <3.1.0 | |
| Discourse Discourse | =3.1.0-beta1 | |
| Discourse Discourse | =3.1.0-beta2 | |
| Discourse Discourse | =3.1.0-beta3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2023-29196?
CVE-2023-29196 is a vulnerability in Discourse, an open source platform for community discussion.
Is CVE-2023-29196 exploitable on the default install of Discourse?
No, CVE-2023-29196 is not exploitable on the default install of Discourse.
What must be enabled for CVE-2023-29196 to work?
A custom feature must be enabled for CVE-2023-29196 to work in Discourse.
What should the attacker's payload pass to execute CVE-2023-29196?
The attacker's payload must pass the Content Security Policy (CSP) to be executed.
Which versions of Discourse are affected by CVE-2023-29196?
Versions up to 3.0.3 stable and up to 3.1.0 beta are affected by CVE-2023-29196.
What is the severity of CVE-2023-29196?
The severity of CVE-2023-29196 is medium with a CVSS score of 6.1.
How can I fix CVE-2023-29196?
There is no available fix for CVE-2023-29196 at the moment, but updating to the latest version of Discourse when it becomes available is advised.
Where can I find more information about CVE-2023-29196?
You can find more information about CVE-2023-29196 in the advisory on the Discourse GitHub page.
What is the CWE ID for CVE-2023-29196?
The CWE ID for CVE-2023-29196 is CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
- collector/nvd-index
- agent/weakness
- vendor/discourse
- canonical/discourse discourse
- version/discourse discourse/3.1.0-beta1
- version/discourse discourse/3.1.0-beta2
- version/discourse discourse/3.1.0-beta3