CVE-2023-22454

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 3.0.0.beta16 on the `beta` and `tests-passed` branches, pending post titles can be used for cross-site scripting attacks. Pending posts can be created by unprivileged users when a category has the "require moderator approval of all new topics" setting set. This vulnerability can lead to a full XSS on sites which have modified or disabled Discourse’s default Content Security Policy. A patch is available in versions 2.8.14 and 3.0.0.beta16.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
discourse	discourse	< 2.8.14; >= 2.9.0.beta0, < 3.0.0.beta16

References

https://github.com/discourse/discourse/commit/c0e2d7badac276d82a4056a994b48d68a8993a12Patch, Third Party Advisory
https://github.com/discourse/discourse/security/advisories/GHSA-ggq4-4qxc-c462Third Party Advisory
https://github.com/discourse/discourse/commit/c0e2d7badac276d82a4056a994b48d68a8993a12Patch, Third Party Advisory
https://github.com/discourse/discourse/security/advisories/GHSA-ggq4-4qxc-c462Third Party Advisory

Timeline

Published: Jan 5, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-224556.1Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 3.0.0.beta16 on the `beta` and CVE-2023-224566.1ViewVC, a browser interface for CVS and Subversion version control repositories, as a cross-site scripting vulnerability that affects versio CVE-2023-224578.8CKEditor Integration UI adds support for editing wiki pages using CKEditor. Prior to versions 1.64.3,t he `CKEditor.HTMLConverter` document CVE-2023-224585.5Redis is an in-memory database that persists on disk. Authenticated users can issue a `HRANDFIELD` or `ZRANDMEMBER` command with specially c CVE-2023-22469.8A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. This vulnerability affects unk CVE-2023-224607.5go-ipld-prime is an implementation of the InterPlanetary Linked Data (IPLD) spec interfaces, a batteries-included codec implementations of I CVE-2023-224616.1The `sanitize-svg` package, a small SVG sanitizer to prevent cross-site scripting attacks, uses a deny-list-pattern to sanitize SVGs to prev CVE-2023-224625.4Grafana is an open-source platform for monitoring and observability. On 2023-01-01 during an internal audit of Grafana, a member of the secu CVE-2023-224639.8KubePi is a k8s panel. The jwt authentication function of KubePi through version 1.6.2 uses hard-coded Jwtsigkeys, resulting in the same Jwt CVE-2023-224645.4ViewVC is a browser interface for CVS and Subversion version control repositories. Versions prior to 1.2.3 and 1.1.30 are vulnerable to cros CVE-2023-224655.3Http4s is a Scala interface for HTTP services. Starting with version 0.1.0 and prior to versions 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38, t CVE-2023-224665.4Tokio is a runtime for writing applications with Rust. Starting with version 1.7.0 and prior to versions 1.18.4, 1.20.3, and 1.23.1, when co