CVE-2023-43657: Improper escaping of encrypted topic titles can lead to Cross-site Scripting under non-default site configuration
discourse-encrypt is a plugin that provides a secure communication channel through Discourse. Improper escaping of encrypted topic titles could lead to a cross site scripting (XSS) issue when a site has content security policy (CSP) headers disabled. Having CSP disabled is a non-default configuration, and having it disabled with discourse-encrypt installed will result in a warning in the Discourse admin dashboard. This has been fixed in commit 9c75810af9 which is included in the latest version of the discourse-encrypt plugin. Users are advised to upgrade. Users unable to upgrade should ensure that CSP headers are enabled and properly configured.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-43657?
CVE-2023-43657 is a vulnerability in the discourse-encrypt plugin that allows for cross site scripting (XSS) attacks.
What is the severity of CVE-2023-43657?
The severity of CVE-2023-43657 is high, with a severity value of 6.1.
How does CVE-2023-43657 occur?
CVE-2023-43657 occurs due to improper escaping of encrypted topic titles, which can lead to a cross site scripting (XSS) issue.
How can I fix CVE-2023-43657?
To fix CVE-2023-43657, it is recommended to update to the latest version of the discourse-encrypt plugin and enable Content Security Policy (CSP) headers.
Where can I find more information about CVE-2023-43657?
More information about CVE-2023-43657 can be found in the references provided: [link1], [link2], [link3].