CVE-2023-36473: CSP nonce reuse vulnerability in Discourse
Published Jul 13, 2023
·Updated
Discourse is an open source discussion platform. A CSP (Content Security Policy) nonce reuse vulnerability could allow XSS attacks to bypass CSP protection. There are no known XSS vectors at the moment, but should one be discovered, this vulnerability would allow the XSS attack to completely bypass CSP. The vulnerability is patched in the latest tests-passed, beta and stable branches.
Affected Software
210 affected components
Discourse Discourse<3.0.5
Discourse Discourse=1.1.0-beta1
Discourse Discourse=1.1.0-beta2
Discourse Discourse=1.1.0-beta3
Discourse Discourse=1.1.0-beta4
Discourse Discourse=1.1.0-beta5
Discourse Discourse=1.1.0-beta6
Discourse Discourse=1.1.0-beta6b
Discourse Discourse=1.1.0-beta7
Discourse Discourse=1.1.0-beta8
Discourse Discourse=1.2.0-beta1
Discourse Discourse=1.2.0-beta2
Discourse Discourse=1.2.0-beta3
Discourse Discourse=1.2.0-beta4
Discourse Discourse=1.2.0-beta5
Discourse Discourse=1.2.0-beta6
Discourse Discourse=1.2.0-beta7
Discourse Discourse=1.2.0-beta8
Discourse Discourse=1.2.0-beta9
Discourse Discourse=1.3.0-beta1
Discourse Discourse=1.3.0-beta10
Discourse Discourse=1.3.0-beta11
Discourse Discourse=1.3.0-beta2
Discourse Discourse=1.3.0-beta3
Discourse Discourse=1.3.0-beta4
Discourse Discourse=1.3.0-beta5
Discourse Discourse=1.3.0-beta6
Discourse Discourse=1.3.0-beta7
Discourse Discourse=1.3.0-beta8
Discourse Discourse=1.3.0-beta9
Discourse Discourse=1.4.0-beta1
Discourse Discourse=1.4.0-beta10
Discourse Discourse=1.4.0-beta11
Discourse Discourse=1.4.0-beta12
Discourse Discourse=1.4.0-beta2
Discourse Discourse=1.4.0-beta3
Discourse Discourse=1.4.0-beta4
Discourse Discourse=1.4.0-beta5
Discourse Discourse=1.4.0-beta6
Discourse Discourse=1.4.0-beta7
Discourse Discourse=1.4.0-beta8
Discourse Discourse=1.4.0-beta9
Discourse Discourse=1.5.0-beta1
Discourse Discourse=1.5.0-beta10
Discourse Discourse=1.5.0-beta11
Discourse Discourse=1.5.0-beta12
Discourse Discourse=1.5.0-beta13
Discourse Discourse=1.5.0-beta13b
Discourse Discourse=1.5.0-beta14
Discourse Discourse=1.5.0-beta2
Discourse Discourse=1.5.0-beta3
Discourse Discourse=1.5.0-beta4
Discourse Discourse=1.5.0-beta5
Discourse Discourse=1.5.0-beta6
Discourse Discourse=1.5.0-beta7
Discourse Discourse=1.5.0-beta8
Discourse Discourse=1.5.0-beta9
Discourse Discourse=1.6.0-beta1
Discourse Discourse=1.6.0-beta10
Discourse Discourse=1.6.0-beta11
Discourse Discourse=1.6.0-beta12
Discourse Discourse=1.6.0-beta2
Discourse Discourse=1.6.0-beta3
Discourse Discourse=1.6.0-beta4
Discourse Discourse=1.6.0-beta5
Discourse Discourse=1.6.0-beta6
Discourse Discourse=1.6.0-beta7
Discourse Discourse=1.6.0-beta8
Discourse Discourse=1.6.0-beta9
Discourse Discourse=1.7.0-beta1
Discourse Discourse=1.7.0-beta10
Discourse Discourse=1.7.0-beta11
Discourse Discourse=1.7.0-beta2
Discourse Discourse=1.7.0-beta3
Discourse Discourse=1.7.0-beta4
Discourse Discourse=1.7.0-beta5
Discourse Discourse=1.7.0-beta6
Discourse Discourse=1.7.0-beta7
Discourse Discourse=1.7.0-beta8
Discourse Discourse=1.7.0-beta9
Discourse Discourse=1.8.0-beta1
Discourse Discourse=1.8.0-beta10
Discourse Discourse=1.8.0-beta11
Discourse Discourse=1.8.0-beta12
Discourse Discourse=1.8.0-beta13
Discourse Discourse=1.8.0-beta2
Discourse Discourse=1.8.0-beta3
Discourse Discourse=1.8.0-beta4
Discourse Discourse=1.8.0-beta5
Discourse Discourse=1.8.0-beta6
Discourse Discourse=1.8.0-beta7
Discourse Discourse=1.8.0-beta8
Discourse Discourse=1.8.0-beta9
Discourse Discourse=1.9.0-beta1
Discourse Discourse=1.9.0-beta10
Discourse Discourse=1.9.0-beta11
Discourse Discourse=1.9.0-beta12
Discourse Discourse=1.9.0-beta13
Discourse Discourse=1.9.0-beta14
Discourse Discourse=1.9.0-beta15
Discourse Discourse=1.9.0-beta16
Discourse Discourse=1.9.0-beta17
Discourse Discourse=1.9.0-beta2
Discourse Discourse=1.9.0-beta3
Discourse Discourse=1.9.0-beta4
Discourse Discourse=1.9.0-beta5
Discourse Discourse=1.9.0-beta6
Discourse Discourse=1.9.0-beta7
Discourse Discourse=1.9.0-beta8
Discourse Discourse=1.9.0-beta9
Discourse Discourse=2.0.0-beta1
Discourse Discourse=2.0.0-beta10
Discourse Discourse=2.0.0-beta2
Discourse Discourse=2.0.0-beta3
Discourse Discourse=2.0.0-beta4
Discourse Discourse=2.0.0-beta5
Discourse Discourse=2.0.0-beta6
Discourse Discourse=2.0.0-beta7
Discourse Discourse=2.0.0-beta8
Discourse Discourse=2.0.0-beta9
Discourse Discourse=2.1.0-beta1
Discourse Discourse=2.1.0-beta2
Discourse Discourse=2.1.0-beta3
Discourse Discourse=2.1.0-beta4
Discourse Discourse=2.1.0-beta5
Discourse Discourse=2.1.0-beta6
Discourse Discourse=2.2.0-beta1
Discourse Discourse=2.2.0-beta10
Discourse Discourse=2.2.0-beta2
Discourse Discourse=2.2.0-beta3
Discourse Discourse=2.2.0-beta4
Discourse Discourse=2.2.0-beta5
Discourse Discourse=2.2.0-beta6
Discourse Discourse=2.2.0-beta7
Discourse Discourse=2.2.0-beta8
Discourse Discourse=2.2.0-beta9
Discourse Discourse=2.3.0-beta1
Discourse Discourse=2.3.0-beta10
Discourse Discourse=2.3.0-beta11
Discourse Discourse=2.3.0-beta2
Discourse Discourse=2.3.0-beta3
Discourse Discourse=2.3.0-beta4
Discourse Discourse=2.3.0-beta5
Discourse Discourse=2.3.0-beta6
Discourse Discourse=2.3.0-beta7
Discourse Discourse=2.3.0-beta8
Discourse Discourse=2.3.0-beta9
Discourse Discourse=2.4.0-beta1
Discourse Discourse=2.4.0-beta10
Discourse Discourse=2.4.0-beta11
Discourse Discourse=2.4.0-beta2
Discourse Discourse=2.4.0-beta3
Discourse Discourse=2.4.0-beta4
Discourse Discourse=2.4.0-beta5
Discourse Discourse=2.4.0-beta6
Discourse Discourse=2.4.0-beta7
Discourse Discourse=2.4.0-beta8
Discourse Discourse=2.4.0-beta9
Discourse Discourse=2.5.0-beta1
Discourse Discourse=2.5.0-beta2
Discourse Discourse=2.5.0-beta3
Discourse Discourse=2.5.0-beta4
Discourse Discourse=2.5.0-beta5
Discourse Discourse=2.5.0-beta6
Discourse Discourse=2.5.0-beta7
Discourse Discourse=2.6.0-beta1
Discourse Discourse=2.6.0-beta2
Discourse Discourse=2.6.0-beta3
Discourse Discourse=2.6.0-beta4
Discourse Discourse=2.6.0-beta5
Discourse Discourse=2.6.0-beta6
Discourse Discourse=2.7.0-beta1
Discourse Discourse=2.7.0-beta2
Discourse Discourse=2.7.0-beta3
Discourse Discourse=2.7.0-beta4
Discourse Discourse=2.7.0-beta5
Discourse Discourse=2.7.0-beta6
Discourse Discourse=2.7.0-beta7
Discourse Discourse=2.7.0-beta8
Discourse Discourse=2.7.0-beta9
Discourse Discourse=2.8.0-beta1
Discourse Discourse=2.8.0-beta10
Discourse Discourse=2.8.0-beta11
Discourse Discourse=2.8.0-beta2
Discourse Discourse=2.8.0-beta3
Discourse Discourse=2.8.0-beta4
Discourse Discourse=2.8.0-beta5
Discourse Discourse=2.8.0-beta6
Discourse Discourse=2.8.0-beta7
Discourse Discourse=2.8.0-beta8
Discourse Discourse=2.8.0-beta9
Discourse Discourse=2.9.0-beta1
Discourse Discourse=2.9.0-beta10
Discourse Discourse=2.9.0-beta11
Discourse Discourse=2.9.0-beta12
Discourse Discourse=2.9.0-beta13
Discourse Discourse=2.9.0-beta14
Discourse Discourse=2.9.0-beta2
Discourse Discourse=2.9.0-beta3
Discourse Discourse=2.9.0-beta4
Discourse Discourse=2.9.0-beta5
Discourse Discourse=2.9.0-beta6
Discourse Discourse=2.9.0-beta7
Discourse Discourse=2.9.0-beta8
Discourse Discourse=2.9.0-beta9
Discourse Discourse=3.0.0-beta15
Discourse Discourse=3.0.0-beta16
Discourse Discourse=3.1.0-beta1
Discourse Discourse=3.1.0-beta2
Discourse Discourse=3.1.0-beta5
Event History
Jul 13, 2023
CVE Published
via MITRE·08:57 PM
Data Sourced
via MITRE·08:57 PM
DescriptionSeverityWeakness
Data Sourced
09:15 PM
DescriptionWeakness
Data Sourced
via NVD·09:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2023-36473?
The severity of CVE-2023-36473 has not been explicitly rated but it can potentially allow XSS attacks if an exploit is discovered.
2
How do I fix CVE-2023-36473?
To fix CVE-2023-36473, you should update your Discourse installation to the latest version beyond 3.0.5.
3
What types of software are affected by CVE-2023-36473?
CVE-2023-36473 affects Discourse versions up to 3.0.5 and several beta versions of Discourse.
4
What does CVE-2023-36473 entail?
CVE-2023-36473 describes a Content Security Policy nonce reuse vulnerability that may enable XSS attacks.
5
Are there any known exploits for CVE-2023-36473?
Currently, there are no known XSS vectors exploiting CVE-2023-36473.