CVE-2023-43657

CVSS 3.1 Score 6.1 of 10 (medium)

Details

Published Sep 28, 2023
Updated: Oct 2, 2023
CWE ID 79

Summary

CVE-2023-43657 is a vulnerability related to the discourse-encrypt plugin, which provides secure communication through Discourse. The issue arises from improper escaping of encrypted topic titles, potentially leading to cross-site scripting (XSS) attacks when a site has disabled content security policy (CSP) headers. This configuration is non-default, and if CSP is disabled with discourse-encrypt installed, a warning will be displayed in the Discourse admin dashboard. The vulnerability has been fixed in the latest version of the plugin (commit 9c75810af9), so users are advised to upgrade. For those unable to upgrade, it is recommended to enable and properly configure CSP headers to mitigate the risk. The vulnerability has a base severity of MEDIUM, requiring user interaction over a network connection, with low impacts on integrity and confidentiality.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-43657 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options