CVE-2022-39232

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Discourse is an open source discussion platform. Starting with version 2.9.0.beta5 and prior to version 2.9.0.beta10, an incomplete quote can generate a JavaScript error which will crash the current page in the browser in some cases. Version 2.9.0.beta10 added a fix and tests to ensure incomplete quotes won't break the app. As a workaround, the quote can be fixed via the rails console.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
discourse	discourse	>= 2.9.0.beta5, < 2.9.0.beta10

References

https://github.com/discourse/discourse/commit/eab33af5bf19827527fe79134d865b5c727f6530Patch, Third Party Advisory
https://github.com/discourse/discourse/pull/18311Patch, Third Party Advisory
https://github.com/discourse/discourse/security/advisories/GHSA-cv64-v73f-7wq5Third Party Advisory
https://github.com/discourse/discourse/commit/eab33af5bf19827527fe79134d865b5c727f6530Patch, Third Party Advisory
https://github.com/discourse/discourse/pull/18311Patch, Third Party Advisory
https://github.com/discourse/discourse/security/advisories/GHSA-cv64-v73f-7wq5Third Party Advisory

Timeline

Published: Sep 29, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-392335.4Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions 12.9.99.228 and above, pr CVE-2022-392348.8GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service CVE-2022-392365.3Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Starting with version 17.1.0-rc.1, improperly formed beacon events can CVE-2022-392379.8syslabs/sif is the Singularity Image Format (SIF) reference implementation. In versions prior to 2.8.1the `github.com/sylabs/sif/v2/pkg/inte CVE-2022-392388.8Arvados is an open source platform for managing and analyzing biomedical big data. In versions prior to 2.4.3, when using Portable Authentic CVE-2022-392395.4netlify-ipx is an on-Demand image optimization for Netlify using ipx. In versions prior to 1.2.3, an attacker can bypass the source image do CVE-2022-39247.5This issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also make use of the option `stale-answer-client-timeout`, confi CVE-2022-392405.4MyGraph is a permission management system. Versions prior to 1.0.4 are vulnerable to a storage XSS vulnerability leading to Remote Code Exec CVE-2022-392414.9Discourse is a platform for community discussion. A malicious admin could use this vulnerability to perform port enumeration on the local ho CVE-2022-392425.3Frontier is an Ethereum compatibility layer for Substrate. Prior to commit d3beddc6911a559a3ecc9b3f08e153dbe37a8658, the worst case weight w CVE-2022-392439.8NuProcess is an external process execution implementation for Java. In all the versions of NuProcess where it forks processes by using the J CVE-2022-392449.8PJSIP is a free and open source multimedia communication library written in C. In versions of PJSIP prior to 2.13 the PJSIP parser, PJMEDIA