CVE-2023-25172 - Vulnerability Details - OpenCVE

Discourse is an open-source discussion platform. Prior to version 3.0.1 of the `stable` branch and version 3.1.0.beta2 of the `beta` and `tests-passed` branches, a maliciously crafted URL can be included in a user's full name field to to carry out cross-site scripting attacks on sites with a disabled or overly permissive CSP (Content Security Policy). Discourse's default CSP prevents this vulnerability. The vulnerability is patched in version 3.0.1 of the `stable` branch and version 3.1.0.beta2 of the `beta` and `tests-passed` branches. As a workaround, enable and/or restore your site's CSP to the default one provided with Discourse.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Discourse	Discourse

Configuration 1 [-]

OR	cpe:2.3:a:discourse:discourse:::::stable:::*
	cpe:2.3:a:discourse:discourse:::::beta:::*
	cpe:2.3:a:discourse:discourse:3.1.0:beta1:::beta:::*

No data.

References

Link	Providers
https://github.com/discourse/discourse/commit/1a5a6f66cb821ed29a737311d6fdc2eba5adc915
https://github.com/discourse/discourse/commit/c186a46910431020e8efc425dec2133e7a99fa9a
https://github.com/discourse/discourse/pull/20008
https://github.com/discourse/discourse/pull/20009
https://github.com/discourse/discourse/security/advisories/GHSA-7pm2-prxw-wrvp

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2023-03-17T16:07:27.668Z

Updated: 2024-08-02T11:18:36.267Z

Reserved: 2023-02-03T16:59:18.247Z

Link: CVE-2023-25172

Vulnrichment

No data.

NVD

Status : Modified

Published: 2023-03-17T17:15:11.423

Modified: 2024-11-21T07:49:14.957

Link: CVE-2023-25172

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-25172", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-02-03T16:59:18.247Z", "datePublished": "2023-03-17T16:07:27.668Z", "dateUpdated": "2024-08-02T11:18:36.267Z"}, "containers": {"cna": {"title": "Discourse vulnerable to Cross-site Scripting - user name displayed on post", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/discourse/discourse/security/advisories/GHSA-7pm2-prxw-wrvp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/discourse/discourse/security/advisories/GHSA-7pm2-prxw-wrvp"}, {"name": "https://github.com/discourse/discourse/pull/20008", "tags": ["x_refsource_MISC"], "url": "https://github.com/discourse/discourse/pull/20008"}, {"name": "https://github.com/discourse/discourse/pull/20009", "tags": ["x_refsource_MISC"], "url": "https://github.com/discourse/discourse/pull/20009"}, {"name": "https://github.com/discourse/discourse/commit/1a5a6f66cb821ed29a737311d6fdc2eba5adc915", "tags": ["x_refsource_MISC"], "url": "https://github.com/discourse/discourse/commit/1a5a6f66cb821ed29a737311d6fdc2eba5adc915"}, {"name": "https://github.com/discourse/discourse/commit/c186a46910431020e8efc425dec2133e7a99fa9a", "tags": ["x_refsource_MISC"], "url": "https://github.com/discourse/discourse/commit/c186a46910431020e8efc425dec2133e7a99fa9a"}], "affected": [{"vendor": "discourse", "product": "discourse", "versions": [{"version": "stable < 3.0.1", "status": "affected"}, {"version": "beta < 3.1.0.beta2", "status": "affected"}, {"version": "tests-passed < 3.1.0.beta2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-03-17T16:07:27.668Z"}, "descriptions": [{"lang": "en", "value": "Discourse is an open-source discussion platform. Prior to version 3.0.1 of the `stable` branch and version 3.1.0.beta2 of the `beta` and `tests-passed` branches, a maliciously crafted URL can be included in a user's full name field to to carry out cross-site scripting attacks on sites with a disabled or overly permissive CSP (Content Security Policy). Discourse's default CSP prevents this vulnerability. The vulnerability is patched in version 3.0.1 of the `stable` branch and version 3.1.0.beta2 of the `beta` and `tests-passed` branches. As a workaround, enable and/or restore your site's CSP to the default one provided with Discourse."}], "source": {"advisory": "GHSA-7pm2-prxw-wrvp", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T11:18:36.267Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/discourse/discourse/security/advisories/GHSA-7pm2-prxw-wrvp", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/discourse/discourse/security/advisories/GHSA-7pm2-prxw-wrvp"}, {"name": "https://github.com/discourse/discourse/pull/20008", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/discourse/discourse/pull/20008"}, {"name": "https://github.com/discourse/discourse/pull/20009", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/discourse/discourse/pull/20009"}, {"name": "https://github.com/discourse/discourse/commit/1a5a6f66cb821ed29a737311d6fdc2eba5adc915", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/discourse/discourse/commit/1a5a6f66cb821ed29a737311d6fdc2eba5adc915"}, {"name": "https://github.com/discourse/discourse/commit/c186a46910431020e8efc425dec2133e7a99fa9a", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/discourse/discourse/commit/c186a46910431020e8efc425dec2133e7a99fa9a"}]}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*", "matchCriteriaId": "C19D7945-EB52-43C0-B9B7-8C250FEDC451", "versionEndExcluding": "3.0.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:beta:*:*:*", "matchCriteriaId": "D3C08972-822D-4657-9B6F-02BC692B7C6E", "versionEndExcluding": "3.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:discourse:discourse:3.1.0:beta1:*:*:beta:*:*:*", "matchCriteriaId": "B9BBED17-A6BA-4F17-8814-8D8521F28375", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Discourse is an open-source discussion platform. Prior to version 3.0.1 of the `stable` branch and version 3.1.0.beta2 of the `beta` and `tests-passed` branches, a maliciously crafted URL can be included in a user's full name field to to carry out cross-site scripting attacks on sites with a disabled or overly permissive CSP (Content Security Policy). Discourse's default CSP prevents this vulnerability. The vulnerability is patched in version 3.0.1 of the `stable` branch and version 3.1.0.beta2 of the `beta` and `tests-passed` branches. As a workaround, enable and/or restore your site's CSP to the default one provided with Discourse."}], "id": "CVE-2023-25172", "lastModified": "2024-11-21T07:49:14.957", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-03-17T17:15:11.423", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/discourse/discourse/commit/1a5a6f66cb821ed29a737311d6fdc2eba5adc915"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/discourse/discourse/commit/c186a46910431020e8efc425dec2133e7a99fa9a"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/discourse/discourse/pull/20008"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/discourse/discourse/pull/20009"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/discourse/discourse/security/advisories/GHSA-7pm2-prxw-wrvp"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/discourse/discourse/commit/1a5a6f66cb821ed29a737311d6fdc2eba5adc915"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/discourse/discourse/commit/c186a46910431020e8efc425dec2133e7a99fa9a"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/discourse/discourse/pull/20008"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/discourse/discourse/pull/20009"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://github.com/discourse/discourse/security/advisories/GHSA-7pm2-prxw-wrvp"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}