UpHeron
All vulnerabilities

Servers and applications

CVE-2022-46148

Discourse is an open-source messaging platform. In versions 2.8.10 and prior on the `stable` branch and versions 2.9.0.beta11 and prior on the `beta` and `tests-passed` branches, users composing malicious messages and navigating to drafts page could self-XSS. This vulnerability can lead to a full XSS on sites which have modified or disabled Discourse’s default Content Security Policy. This issue…

Severity
Medium 5.4
Published
29 Nov 2022
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
DiscourseServers and applications · cpe:a:discourse:discourse
  • Version 2.9.0-beta11
  • Version 2.9.0-beta10
  • Version 2.9.0-beta8
  • Version 2.9.0-beta7
All 11 release lines
  • Every version up to 2.8.10
  • Version 2.9.0-beta1
  • Version 2.9.0-beta2
  • Version 2.9.0-beta3
  • Version 2.9.0-beta4
  • Version 2.9.0-beta5
  • Version 2.9.0-beta6
  • Version 2.9.0-beta7
  • Version 2.9.0-beta8
  • Version 2.9.0-beta10
  • Version 2.9.0-beta11

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-46148
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-46148