CVE-2023-43659

HIGH

Discourse < 3.1.1 - Cross-Site Scripting via Digest Email Preview UI

Title source: llm
STIX 2.1

Description

Discourse is an open source platform for community discussion. Improper escaping of user input allowed for Cross-site Scripting attacks via the digest email preview UI. This issue only affects sites with CSP disabled. This issue has been patched in the 3.1.1 stable release as well as the 3.2.0.beta1 release. Users are advised to upgrade. Users unable to upgrade should ensure CSP is enabled on the forum.

References (2)

Core 2
Core References
Third Party Advisory x_refsource_misc
https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

Scores

CVSS v3 8.0
EPSS 0.0063
EPSS Percentile 70.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-79
Status published
Products (2)
discourse/discourse 3.2.0 beta1
discourse/discourse < 3.1.1
Published Oct 16, 2023
Tracked Since Feb 18, 2026