CVE-2022-39279

MEDIUM

discourse-chat < 0.9 - Authenticated Stored Cross-Site Scripting via Channel Name and Description

Title source: llm
STIX 2.1

Description

discourse-chat is a plugin for the Discourse message board which adds chat functionality. In versions prior to 0.9 some places render a chat channel's name and description in an unsafe way, allowing staff members to cause an cross site scripting (XSS) attack by inserting unsafe HTML into them. Version 0.9 has addressed this issue. Users are advised to upgrade. There are no known workarounds for this issue.

References (2)

Core 2

Scores

CVSS v3 4.3
EPSS 0.0037
EPSS Percentile 28.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (1)
discourse/discourse-chat < 0.9
Published Oct 06, 2022
Tracked Since Feb 18, 2026