CVE-2021-39161

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Discourse is an open source platform for community discussion. In affected versions category names can be used for Cross-site scripting(XSS) attacks. This is mitigated by Discourse's default Content Security Policy and this vulnerability only affects sites which have modified or disabled or changed Discourse's default Content Security Policy have allowed for moderators to modify categories. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. Users are advised to ensure that the Content Security Policy is enabled, and has not been modified in a way which would make it more vulnerable to XSS attacks.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Aug 26, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-391628.6Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, can abnormally terminate if an H/2 GOAWAY and SET CVE-2021-391633.1Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access t CVE-2021-391643.1Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access t CVE-2021-391656.5Cachet is an open source status page. With Cachet prior to and including 2.3.18, there is a SQL injection which is in the `SearchableTrait#s CVE-2021-391665.4Pimcore is an open source data & experience management platform. Prior to version 10.1.2, text-values were not properly escaped before print CVE-2021-391679.8OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with th CVE-2021-391689.8OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with th CVE-2021-391695.4Misskey is a decentralized microblogging platform. In versions of Misskey prior to 12.51.0, malicious actors can use the web client built-in CVE-2021-39175.5A flaw was found in the coreos-installer, where it writes the Ignition config to the target system with world-readable access permissions. T CVE-2021-391705.4Pimcore is an open source data & experience management platform. Prior to version 10.1.2, an authenticated user could add XSS code as a valu CVE-2021-391717.5Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. Prior to version 3.1.0, a malicious SA CVE-2021-391728.8Cachet is an open source status page system. Prior to version 2.5.1, authenticated users, regardless of their privileges (User or Admin), ca