CVE-2023-25172
Discourse vulnerable to Cross-site Scripting - user name displayed on post
Discourse is an open-source discussion platform. Prior to version 3.0.1 of the stable branch and version 3.1.0.beta2 of the beta and tests-passed branches, a maliciously crafted URL can be included in a user's full name field to to carry out cross-site scripting attacks on sites with a disabled or overly permissive CSP (Content Security Policy). Discourse's default CSP prevents this vulnerability. The vulnerability is patched in version 3.0.1 of the stable branch and version 3.1.0.beta2 of the beta and tests-passed branches. As a workaround, enable and/or restore your site's CSP to the default one provided with Discourse.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Discourse vulnerable to Cross-site Scripting - user name displayed on post
Discourse is an open-source discussion platform. Prior to version 3.0.1 of the stable branch and version 3.1.0.beta2 of the beta and tests-passed branches, a maliciously crafted URL can be included in a user's full name field to to carry out cross-site scripting attacks on sites with a disabled or overly permissive CSP (Content Security Policy). Discourse's default CSP prevents this vulnerability. The vulnerability is patched in version 3.0.1 of the stable branch and version 3.1.0.beta2 of the beta and tests-passed branches. As a workaround, enable and/or restore your site's CSP to the default one provided with Discourse.
- Record
CVE-2023-25172- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2023-29137
Discourse is an open-source discussion platform. Prior to version 3.0.1 of the stable branch and version 3.1.0.beta2 of the beta and tests-passed branches, a maliciously crafted URL can be included in a user's full name field to to carry out cross-site scripting attacks on sites with a disabled or overly permissive CSP (Content Security Policy). Discourse's default CSP prevents this vulnerability. The vulnerability is patched in version 3.0.1 of the stable branch and version 3.1.0.beta2 of the beta and tests-passed branches. As a workaround, enable and/or restore your site's CSP to the default one provided with Discourse.
- Record
EUVD-2023-29137- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
NVD
Discourse is an open-source discussion platform. Prior to version 3.0.1 of the stable branch and version 3.1.0.beta2 of the beta and tests-passed branches, a maliciously crafted URL can be included in a user's full name field to to carry out cross-site scripting attacks on sites with a disabled or overly permissive CSP (Content Security Policy). Discourse's default CSP prevents this vulnerability. The vulnerability is patched in version 3.0.1 of the stable branch and version 3.1.0.beta2 of the beta and tests-passed branches. As a workaround, enable and/or restore your site's CSP to the default one provided with Discourse.
- Record
CVE-2023-25172- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Discourse vulnerable to Cross-site Scripting - user name displayed on post
Discourse is an open-source discussion platform. Prior to version 3.0.1 of the stable branch and version 3.1.0.beta2 of the beta and tests-passed branches, a maliciously crafted URL can be included in a user's full name field to to carry out cross-site scripting attacks on sites with a disabled or overly permissive CSP (Content Security Policy). Discourse's default CSP prevents this vulnerability. The vulnerability is patched in version 3.0.1 of the stable branch and version 3.1.0.beta2 of the beta and tests-passed branches. As a workaround, enable and/or restore your site's CSP to the default one provided with Discourse.
- Record
CVE-2023-25172- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVBIT-discourse-2023-25172 No score
Discourse vulnerable to Cross-site Scripting - user name displayed on post
Discourse is an open-source discussion platform. Prior to version 3.0.1 of the stable branch and version 3.1.0.beta2 of the beta and tests-passed branches, a maliciously crafted URL can be included in a user's full name field to to carry out cross-site scripting attacks on sites with a disabled or overly permissive CSP (Content Security Policy). Discourse's default CSP prevents this vulnerability. The vulnerability is patched in version 3.0.1 of the stable branch and version 3.1.0.beta2 of the beta and tests-passed branches. As a workaround, enable and/or restore your site's CSP to the default one provided with Discourse.
- Record
BIT-discourse-2023-25172- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
discourseBitnami |
before 3.1.0 | 3.1.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-25172 is a medium vulnerability (CVSS 4.4) in Discourse, published March 17, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.53%, the 45th percentile. Fixed in discourse 3.1.0.
References
github.com/discourse/discourse/security/advisories/GHSA-7pm2-prxw-wrvp
nvd.nist.gov/vuln/detail/CVE-2023-25172