UpHeron
All vulnerabilities

Servers and applications

CVE-2023-29196

Discourse is an open source platform for community discussion. This vulnerability is not exploitable on the default install of Discourse. A custom feature must be enabled for it to work at all, and the attacker’s payload must pass the CSP to be executed. However, if an attacker succeeds in embedding Javascript that does pass the CSP, it could result in session hijacking for any users that view…

Severity
Medium 6.1
Published
18 Apr 2023
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
3.0.3, 3.1.0
Sources
NVD

Affected software

SoftwareAffected versions
DiscourseServers and applications · cpe:a:discourse:discourse
  • Every version before 3.0.3
  • Every version before 3.1.0
  • Version 3.1.0-beta1
  • Version 3.1.0-beta2
  • Version 3.1.0-beta3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-29196
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-29196