CVE-2023-36473 — CSP nonce reuse vulnerability in Discourse

Description (CNA)

Discourse is an open source discussion platform. A CSP (Content Security Policy) nonce reuse vulnerability could allow XSS attacks to bypass CSP protection. There are no known XSS vectors at the moment, but should one be discovered, this vulnerability would allow the XSS attack to completely bypass CSP. The vulnerability is patched in the latest tests-passed, beta and stable branches.

Affected (CNA)

Vendor / product	Versions
discourse / discourse	affected stable >= 3.0.5; affected beta >= 3.1.0.beta6; affected tests-passed >= 3.1.0.beta6

CWE

CWE-79

References

https://github.com/discourse/discourse/security/advisories/GHSA-9f52-624j-8ppq

ADP enrichment

CVE

No English description supplied.

https://github.com/discourse/discourse/security/advisories/GHSA-9f52-624j-8ppq

CISA-ADP

No English description supplied.

No references supplied.