Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-46148

Discourse is an open-source messaging platform. In versions 2.8.10 and prior on the `stable` branch and versions 2.9.0.beta11 and prior on the `beta` and `tests-passed` branches, users composing malicious messages and navigating to drafts page could self-XSS. This vulnerability can lead to a full XSS on sites which have modified or disabled Discourse’s default Content Security Policy. This issue is patched in the latest stable, beta and tests-passed versions of Discourse.

Published

2022-11-29T17:15:11.370

Last Modified

2024-11-21T07:30:12.280

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.1 (HIGH)

Weaknesses
  • Type: Secondary
    CWE-79
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application discourse discourse ≤ 2.8.10 Yes
Application discourse discourse 2.9.0 Yes
Application discourse discourse 2.9.0 Yes
Application discourse discourse 2.9.0 Yes
Application discourse discourse 2.9.0 Yes
Application discourse discourse 2.9.0 Yes
Application discourse discourse 2.9.0 Yes
Application discourse discourse 2.9.0 Yes
Application discourse discourse 2.9.0 Yes
Application discourse discourse 2.9.0 Yes
Application discourse discourse 2.9.0 Yes
References