CVE-2023-32061

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches, the lack of restrictions on the iFrame tag makes it easy for an attacker to exploit the vulnerability and hide subsequent comments from other users. This issue is patched in version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches. There are no known workarounds.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Jun 13, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-320624.3OroPlatform is a package that assists system and user calendar management. Back-office users can access information from any system calendar CVE-2023-320635.0OroCalendarBundle enables a Calendar feature and related functionality in Oro applications. Back-office users can access information from an CVE-2023-320644.3OroCommerce package with customer portal and non authenticated visitor website base features. Back-office users can access information about CVE-2023-320655.8OroCommerce is an open-source Business to Business Commerce application built with flexibility in mind. Detailed Order totals information ma CVE-2023-320665.4Time Tracker is an open source time tracking system. The week view plugin in Time Tracker versions 1.22.11.5782 and prior was not escaping t CVE-2023-320677.5c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forg CVE-2023-320686.1XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 14.10.4 it's p CVE-2023-320698.8XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-2 and prior to versions 14.10.4 and 15.0-rc-1, it's possible fo CVE-2023-320706.1XWiki Platform is a generic wiki platform. Prior to version 14.6-rc-1, HTML rendering didn't check for dangerous attributes/attribute values CVE-2023-320719.0XWiki Platform is a generic wiki platform. Starting in versions 2.2-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, it's p CVE-2023-320724.8Tuleap is an open source tool for end to end traceability of application and system developments. Tuleap Community Edition prior to version CVE-2023-320738.8WWBN AVideo is an open source video platform. In versions 12.4 and prior, a command injection vulnerability exists at `plugin/CloneSite/clon