Medium severity · published Oct 6, 2022
CVE-2022-39279
Discourse-chat plugin susceptible to XSS in channel name and description
5.4
CVSS
0.5%
EPSS
No
On KEV
Description
discourse-chat is a plugin for the Discourse message board which adds chat functionality. In versions prior to 0.9 some places render a chat channel's name and description in an unsafe way, allowing staff members to cause an cross site scripting (XSS) attack by inserting unsafe HTML into them. Version 0.9 has addressed this issue. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DI
discourse-chat · discourse
< 0.9 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-39279
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-39279
Patch
https://github.com/discourse/discourse-chat/commit/25737733af48e5b9fa60b0561d7fde14bea13cce
Third Party Advisory
https://github.com/discourse/discourse-chat/security/advisories/GHSA-qp62-8m3c-9jgj
More from discourse-chat
6.5
CVE-2022-31095
discourse-chat is a chat plugin for the Discourse application
4.8
CVE-2022-36057
Discourse-Chat is an asynchronous messaging plugin for the Discourse open-source discussion platform