CVE-2023-36473
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Discourse, an open source discussion platform, has a nonce reuse vulnerability in its Content Security Policy (CSP) that could allow XSS attacks to bypass CSP protection. Currently, there are no known XSS vectors, but if one is discovered, this vulnerability would allow XSS attacks to completely bypass CSP.
Risk Assessment
Organizations using Discourse may be at risk of XSS attacks that could lead to data theft or session hijacking if attack vectors are discovered.
Recommendation
It is recommended to update to the latest version that includes patches for this vulnerability to minimize the risk of potential attacks.
Original NVD description (English source)
Discourse is an open source discussion platform. A CSP (Content Security Policy) nonce reuse vulnerability could allow XSS attacks to bypass CSP protection. There are no known XSS vectors at the moment, but should one be discovered, this vulnerability would allow the XSS attack to completely bypass CSP. The vulnerability is patched in the latest tests-passed, beta and stable branches.