CVE-2022-39232

Discourse vulnerable to incomplete quote causing a topic to crash in the browser

Severity Score

4.3

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Discourse is an open source discussion platform. Starting with version 2.9.0.beta5 and prior to version 2.9.0.beta10, an incomplete quote can generate a JavaScript error which will crash the current page in the browser in some cases. Version 2.9.0.beta10 added a fix and tests to ensure incomplete quotes won't break the app. As a workaround, the quote can be fixed via the rails console.

Discourse es una plataforma de debate de código abierto. A partir de la versión 2.9.0.beta5 y anteriores a 2.9.0.beta10, una cita incompleta puede generar un error de JavaScript que bloqueará la página actual en el navegador en algunos casos. La versión 2.9.0.beta10 ha añadido una corrección y pruebas para garantizar que las cotizaciones incompletas no rompan la aplicación. Como mitigación, la cotización puede arreglarse por medio de la consola de rails

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2022-09-02 CVE Reserved
2022-09-29 CVE Published
2024-04-21 EPSS Updated
2024-08-03 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-20: Improper Input Validation

CAPEC

References (3)

URL	Tag	Source
https://github.com/discourse/discourse/security/advisories/GHSA-cv64-v73f-7wq5	Third Party Advisory

URL	Date	SRC

URL	Date	SRC
https://github.com/discourse/discourse/commit/eab33af5bf19827527fe79134d865b5c727f6530	2023-07-11
https://github.com/discourse/discourse/pull/18311	2023-07-11

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Discourse Search vendor "Discourse"		Discourse Search vendor "Discourse" for product "Discourse"				2.9.0 Search vendor "Discourse" for product "Discourse" and version "2.9.0"		beta5		Affected
Discourse Search vendor "Discourse"		Discourse Search vendor "Discourse" for product "Discourse"				2.9.0 Search vendor "Discourse" for product "Discourse" and version "2.9.0"		beta6		Affected
Discourse Search vendor "Discourse"		Discourse Search vendor "Discourse" for product "Discourse"				2.9.0 Search vendor "Discourse" for product "Discourse" and version "2.9.0"		beta7		Affected
Discourse Search vendor "Discourse"		Discourse Search vendor "Discourse" for product "Discourse"				2.9.0 Search vendor "Discourse" for product "Discourse" and version "2.9.0"		beta8		Affected
Discourse Search vendor "Discourse"		Discourse Search vendor "Discourse" for product "Discourse"				2.9.0 Search vendor "Discourse" for product "Discourse" and version "2.9.0"		beta9		Affected