CVE-2023-36473

CVSS V2 None CVSS V3 None

Description

Discourse is an open source discussion platform. A CSP (Content Security Policy) nonce reuse vulnerability could allow XSS attacks to bypass CSP protection. There are no known XSS vectors at the moment, but should one be discovered, this vulnerability would allow the XSS attack to completely bypass CSP. The vulnerability is patched in the latest tests-passed, beta and stable branches.

Overview

CVE ID
CVE-2023-36473

Assigner
GitHub_M

Vulnerability Status
PUBLISHED

Published Version
2023-07-13T20:57:50.880Z

Last Modified Date
2023-07-13T20:57:50.880Z

Weakness Enumerations

CWE	URL
CWE-79	http://cwe.mitre.org/data/definitions/79.html

References

Reference URL	Reference Tags
https://github.com/discourse/discourse/security/advisories/GHSA-9f52-624j-8ppq	x_refsource_CONFIRM

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2023-36473
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36473

History

Created	Old Value	New Value	Data Type	Notes
2024-06-25 16:38:53				Added to TrackCVE