CVE-2023-22468

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Discourse is an open source platform for community discussion. Versions prior to 2.8.13 (stable), 3.0.0.beta16 (beta) and 3.0.0beta16 (tests-passed), are vulnerable to cross-site Scripting. A maliciously crafted URL can be included in a post to carry out cross-site scripting attacks on sites with disabled or overly permissive CSP (Content Security Policy). Discourse's default CSP prevents this vulnerability. This vulnerability is patched in versions 2.8.13 (stable), 3.0.0.beta16 (beta) and 3.0.0beta16 (tests-passed). As a workaround, enable and/or restore your site's CSP to the default one provided with Discourse.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jan 26, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-224693.5Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. When getti CVE-2023-22475.3In affected versions of Octopus Deploy it is possible to unmask variable secrets using the variable preview function CVE-2023-224706.5Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. CVE-2023-224714.3Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Broken acc CVE-2023-224728.8Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. It is poss CVE-2023-224732.1Talk-Android enables users to have video & audio calls through Nextcloud on Android. Due to passcode bypass, an attacker is able to access t CVE-2023-224748.1Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server uses the request header CVE-2023-224756.1Canarytokens is an open source tool which helps track activity and actions on your network. A Cross-Site Scripting vulnerability was identif CVE-2023-224764.3Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions prior to 2.25.6, due to insufficient access-level checks, any log CVE-2023-224777.5Mercurius is a GraphQL adapter for Fastify. Any users of Mercurius until version 10.5.0 are subjected to a denial of service attack by sendi CVE-2023-224787.5KubePi is a modern Kubernetes panel. The API interfaces with unauthorized entities and may leak sensitive information. This issue has been p CVE-2023-224796.5KubePi is a modern Kubernetes panel. A session fixation attack allows an attacker to hijack a legitimate user session, versions 1.6.3 and be