Vulnerabilities > CVE-2022-39279 - Unspecified vulnerability in Discourse Discourse-Chat 0.3/0.4

047910
CVSS 5.4 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
LOW
Confidentiality impact
LOW
Integrity impact
LOW
Availability impact
NONE
network
low complexity
discourse
NVD
Published: 2022-10-06
Updated: 2024-11-21

Summary

discourse-chat is a plugin for the Discourse message board which adds chat functionality. In versions prior to 0.9 some places render a chat channel's name and description in an unsafe way, allowing staff members to cause an cross site scripting (XSS) attack by inserting unsafe HTML into them. Version 0.9 has addressed this issue. Users are advised to upgrade. There are no known workarounds for this issue.

Vulnerable Configurations

Part Description Count
Application
Discourse
3

References