CVE-2023-43657
CVSS 3.1 Score 6.1 of 10 (medium)
Details
Summary
CVE-2023-43657 is a vulnerability related to the discourse-encrypt plugin, which provides secure communication through Discourse. The issue arises from improper escaping of encrypted topic titles, potentially leading to cross-site scripting (XSS) attacks when a site has disabled content security policy (CSP) headers. This configuration is non-default, and if CSP is disabled with discourse-encrypt installed, a warning will be displayed in the Discourse admin dashboard. The vulnerability has been fixed in the latest version of the plugin (commit `9c75810af9`), so users are advised to upgrade. For those unable to upgrade, it is recommended to enable and properly configure CSP headers to mitigate the risk. The vulnerability has a base severity of MEDIUM, requiring user interaction over a network connection, with low impacts on integrity and confidentiality.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions