CVE-2022-39279

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

discourse-chat is a plugin for the Discourse message board which adds chat functionality. In versions prior to 0.9 some places render a chat channel's name and description in an unsafe way, allowing staff members to cause an cross site scripting (XSS) attack by inserting unsafe HTML into them. Version 0.9 has addressed this issue. Users are advised to upgrade. There are no known workarounds for this issue.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Oct 6, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-39285.5Hardcoded credential is found in affected products' message queue. An attacker that manages to exploit this vulnerability will be able to ac CVE-2022-392807.5dparse is a parser for Python dependency files. dparse in versions before 0.5.2 contain a regular expression that is vulnerable to a Regular CVE-2022-392816.5fat_free_crm is a an open source, Ruby on Rails customer relationship management platform (CRM). In versions prior to 0.20.1 an authenticate CVE-2022-392827.5FreeRDP is a free remote desktop protocol library and clients. FreeRDP based clients on unix systems using `/parallel` command line switch m CVE-2022-392837.5FreeRDP is a free remote desktop protocol library and clients. All FreeRDP based clients when using the `/video` command line switch might r CVE-2022-392844.3CodeIgniter is a PHP full-stack web framework. In versions prior to 4.2.7 setting `$secure` or `$httponly` value to `true` in `Config\Cookie CVE-2022-392855.4ZoneMinder is a free, open source Closed-circuit television software application The file parameter is vulnerable to a cross site scripting CVE-2022-392868.8Jupyter Core is a package for the core common functionality of Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary CVE-2022-392876.5tiny-csrf is a Node.js cross site request forgery (CSRF) protection middleware. In versions prior to 1.1.0 cookies were not encrypted and th CVE-2022-392887.5fastify is a fast and low overhead web framework, for Node.js. Affected versions of fastify are subject to a denial of service via malicious CVE-2022-392897.5ZoneMinder is a free, open source Closed-circuit television software application. In affected versions the ZoneMinder API Exposes Database L CVE-2022-39299.8Communication between the client and the server application of the affected products is partially done using CORBA (Common Object Request Br