CVE-2023-37467
Discourse CSP nonce reuse vulnerability for anonymous users
Discourse is an open source discussion platform. Prior to version 3.1.0.beta7 of the beta and tests-passed branches, a CSP (Content Security Policy) nonce reuse vulnerability was discovered could allow cross-site scripting (XSS) attacks to bypass CSP protection for anonymous (i.e. unauthenticated) users. There are no known XSS vectors at the moment, but should one be discovered, this vulnerability would allow the XSS attack to bypass CSP and execute successfully. This vulnerability isn't applicable to logged-in users. Version 3.1.0.beta7 contains a patch. The stable branch doesn't have this vulnerability. A workaround to prevent the vulnerability is to disable Google Tag Manager, i.e., unset the gtm container id setting.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Discourse CSP nonce reuse vulnerability for anonymous users
Discourse is an open source discussion platform. Prior to version 3.1.0.beta7 of the beta and tests-passed branches, a CSP (Content Security Policy) nonce reuse vulnerability was discovered could allow cross-site scripting (XSS) attacks to bypass CSP protection for anonymous (i.e. unauthenticated) users. There are no known XSS vectors at the moment, but should one be discovered, this vulnerability would allow the XSS attack to bypass CSP and execute successfully. This vulnerability isn't applicable to logged-in users. Version 3.1.0.beta7 contains a patch. The stable branch doesn't have this vulnerability. A workaround to prevent the vulnerability is to disable Google Tag Manager, i.e., unset the gtm container id setting.
- Record
CVE-2023-37467- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-323
- Updated
- 2026-11-02
EUVDEUVD-2023-41364
Discourse is an open source discussion platform. Prior to version 3.1.0.beta7 of the beta and tests-passed branches, a CSP (Content Security Policy) nonce reuse vulnerability was discovered could allow cross-site scripting (XSS) attacks to bypass CSP protection for anonymous (i.e. unauthenticated) users. There are no known XSS vectors at the moment, but should one be discovered, this vulnerability would allow the XSS attack to bypass CSP and execute successfully. This vulnerability isn't applicable to logged-in users. Version 3.1.0.beta7 contains a patch. The stable branch doesn't have this vulnerability. A workaround to prevent the vulnerability is to disable Google Tag Manager, i.e., unset the gtm container id setting.
- Record
EUVD-2023-41364- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-03
NVD
Discourse is an open source discussion platform. Prior to version 3.1.0.beta7 of the beta and tests-passed branches, a CSP (Content Security Policy) nonce reuse vulnerability was discovered could allow cross-site scripting (XSS) attacks to bypass CSP protection for anonymous (i.e. unauthenticated) users. There are no known XSS vectors at the moment, but should one be discovered, this vulnerability would allow the XSS attack to bypass CSP and execute successfully. This vulnerability isn't applicable to logged-in users. Version 3.1.0.beta7 contains a patch. The stable branch doesn't have this vulnerability. A workaround to prevent the vulnerability is to disable Google Tag Manager, i.e., unset the gtm container id setting.
- Record
CVE-2023-37467- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-323, CWE-79
- Updated
- 2026-11-02
OSV
Discourse CSP nonce reuse vulnerability for anonymous users
Discourse is an open source discussion platform. Prior to version 3.1.0.beta7 of the beta and tests-passed branches, a CSP (Content Security Policy) nonce reuse vulnerability was discovered could allow cross-site scripting (XSS) attacks to bypass CSP protection for anonymous (i.e. unauthenticated) users. There are no known XSS vectors at the moment, but should one be discovered, this vulnerability would allow the XSS attack to bypass CSP and execute successfully. This vulnerability isn't applicable to logged-in users. Version 3.1.0.beta7 contains a patch. The stable branch doesn't have this vulnerability. A workaround to prevent the vulnerability is to disable Google Tag Manager, i.e., unset the gtm container id setting.
- Record
CVE-2023-37467- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-323
- Updated
- 2026-11-02
OSVBIT-discourse-2023-37467 No score
Discourse is an open source discussion platform. Prior to version 3.1.0.beta7 of the beta and tests-passed branches, a CSP (Content Security Policy) nonce reuse vulnerability was discovered could allow cross-site scripting (XSS) attacks to bypass CSP protection for anonymous (i.e. unauthenticated) users. There are no known XSS vectors at the moment, but should one be discovered, this vulnerability would allow the XSS attack to bypass CSP and execute successfully. This vulnerability isn't applicable to logged-in users. Version 3.1.0.beta7 contains a patch. The stable branch doesn't have this vulnerability. A workaround to prevent the vulnerability is to disable Google Tag Manager, i.e., unset the gtm container id setting.
- Record
BIT-discourse-2023-37467- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
discourseBitnami |
1.1.0-beta1 to 1.1.0-beta1, 1.1.0-beta2 to 1.1.0-beta2, 1.1.0-beta3 to 1.1.0-beta3, 1.1.0-beta4 to 1.1.0-beta4, 1.1.0-beta5 to 1.1.0-beta5, 1.1.0-beta6 to 1.1.0-beta6, 1.1.0-beta6b to 1.1.0-beta6b, 1.1.0-beta7 to 1.1.0-beta7, 1.1.0-beta8 to 1.1.0-beta8, 1.2.0-beta1 to 1.2.0-beta1, 1.2.0-beta2 to 1.2.0-beta2, 1.2.0-beta3 to 1.2.0-beta3, 1.2.0-beta4 to 1.2.0-beta4, 1.2.0-beta5 to 1.2.0-beta5, 1.2.0-beta6 to 1.2.0-beta6, 1.2.0-beta7 to 1.2.0-beta7, 1.2.0-beta8 to 1.2.0-beta8, 1.2.0-beta9 to 1.2.0-beta9, 1.3.0-beta1 to 1.3.0-beta1, 1.3.0-beta10 to 1.3.0-beta10, 1.3.0-beta11 to 1.3.0-beta11, 1.3.0-beta2 to 1.3.0-beta2, 1.3.0-beta3 to 1.3.0-beta3, 1.3.0-beta4 to 1.3.0-beta4, 1.3.0-beta5 to 1.3.0-beta5, 1.3.0-beta6 to 1.3.0-beta6, 1.3.0-beta7 to 1.3.0-beta7, 1.3.0-beta8 to 1.3.0-beta8, 1.3.0-beta9 to 1.3.0-beta9, 1.4.0-beta1 to 1.4.0-beta1, 1.4.0-beta10 to 1.4.0-beta10, 1.4.0-beta11 to 1.4.0-beta11, 1.4.0-beta12 to 1.4.0-beta12, 1.4.0-beta2 to 1.4.0-beta2, 1.4.0-beta3 to 1.4.0-beta3, 1.4.0-beta4 to 1.4.0-beta4, 1.4.0-beta5 to 1.4.0-beta5, 1.4.0-beta6 to 1.4.0-beta6, 1.4.0-beta7 to 1.4.0-beta7, 1.4.0-beta8 to 1.4.0-beta8, 1.4.0-beta9 to 1.4.0-beta9, 1.5.0-beta1 to 1.5.0-beta1, 1.5.0-beta10 to 1.5.0-beta10, 1.5.0-beta11 to 1.5.0-beta11, 1.5.0-beta12 to 1.5.0-beta12, 1.5.0-beta13 to 1.5.0-beta13, 1.5.0-beta13b to 1.5.0-beta13b, 1.5.0-beta14 to 1.5.0-beta14, 1.5.0-beta2 to 1.5.0-beta2, 1.5.0-beta3 to 1.5.0-beta3, 1.5.0-beta4 to 1.5.0-beta4, 1.5.0-beta5 to 1.5.0-beta5, 1.5.0-beta6 to 1.5.0-beta6, 1.5.0-beta7 to 1.5.0-beta7, 1.5.0-beta8 to 1.5.0-beta8, 1.5.0-beta9 to 1.5.0-beta9, 1.6.0-beta1 to 1.6.0-beta1, 1.6.0-beta10 to 1.6.0-beta10, 1.6.0-beta11 to 1.6.0-beta11, 1.6.0-beta12 to 1.6.0-beta12, 1.6.0-beta2 to 1.6.0-beta2, 1.6.0-beta3 to 1.6.0-beta3, 1.6.0-beta4 to 1.6.0-beta4, 1.6.0-beta5 to 1.6.0-beta5, 1.6.0-beta6 to 1.6.0-beta6, 1.6.0-beta7 to 1.6.0-beta7, 1.6.0-beta8 to 1.6.0-beta8, 1.6.0-beta9 to 1.6.0-beta9, 1.7.0-beta1 to 1.7.0-beta1, 1.7.0-beta10 to 1.7.0-beta10, 1.7.0-beta11 to 1.7.0-beta11, 1.7.0-beta2 to 1.7.0-beta2, 1.7.0-beta3 to 1.7.0-beta3, 1.7.0-beta4 to 1.7.0-beta4, 1.7.0-beta5 to 1.7.0-beta5, 1.7.0-beta6 to 1.7.0-beta6, 1.7.0-beta7 to 1.7.0-beta7, 1.7.0-beta8 to 1.7.0-beta8, 1.7.0-beta9 to 1.7.0-beta9, 1.8.0-beta1 to 1.8.0-beta1, 1.8.0-beta10 to 1.8.0-beta10, 1.8.0-beta11 to 1.8.0-beta11, 1.8.0-beta12 to 1.8.0-beta12, 1.8.0-beta13 to 1.8.0-beta13, 1.8.0-beta2 to 1.8.0-beta2, 1.8.0-beta3 to 1.8.0-beta3, 1.8.0-beta4 to 1.8.0-beta4, 1.8.0-beta5 to 1.8.0-beta5, 1.8.0-beta6 to 1.8.0-beta6, 1.8.0-beta7 to 1.8.0-beta7, 1.8.0-beta8 to 1.8.0-beta8, 1.8.0-beta9 to 1.8.0-beta9, 1.9.0-beta1 to 1.9.0-beta1, 1.9.0-beta10 to 1.9.0-beta10, 1.9.0-beta11 to 1.9.0-beta11, 1.9.0-beta12 to 1.9.0-beta12, 1.9.0-beta13 to 1.9.0-beta13, 1.9.0-beta14 to 1.9.0-beta14, 1.9.0-beta15 to 1.9.0-beta15, 1.9.0-beta16 to 1.9.0-beta16, 1.9.0-beta17 to 1.9.0-beta17, 1.9.0-beta2 to 1.9.0-beta2, 1.9.0-beta3 to 1.9.0-beta3, 1.9.0-beta4 to 1.9.0-beta4, 1.9.0-beta5 to 1.9.0-beta5, 1.9.0-beta6 to 1.9.0-beta6, 1.9.0-beta7 to 1.9.0-beta7, 1.9.0-beta8 to 1.9.0-beta8, 1.9.0-beta9 to 1.9.0-beta9, 2.0.0-beta1 to 2.0.0-beta1, 2.0.0-beta10 to 2.0.0-beta10, 2.0.0-beta2 to 2.0.0-beta2, 2.0.0-beta3 to 2.0.0-beta3, 2.0.0-beta4 to 2.0.0-beta4, 2.0.0-beta5 to 2.0.0-beta5, 2.0.0-beta6 to 2.0.0-beta6, 2.0.0-beta7 to 2.0.0-beta7, 2.0.0-beta8 to 2.0.0-beta8, 2.0.0-beta9 to 2.0.0-beta9, 2.1.0-beta1 to 2.1.0-beta1, 2.1.0-beta2 to 2.1.0-beta2, 2.1.0-beta3 to 2.1.0-beta3, 2.1.0-beta4 to 2.1.0-beta4, 2.1.0-beta5 to 2.1.0-beta5, 2.1.0-beta6 to 2.1.0-beta6, 2.2.0-beta1 to 2.2.0-beta1, 2.2.0-beta10 to 2.2.0-beta10, 2.2.0-beta2 to 2.2.0-beta2, 2.2.0-beta3 to 2.2.0-beta3, 2.2.0-beta4 to 2.2.0-beta4, 2.2.0-beta5 to 2.2.0-beta5, 2.2.0-beta6 to 2.2.0-beta6, 2.2.0-beta7 to 2.2.0-beta7, 2.2.0-beta8 to 2.2.0-beta8, 2.2.0-beta9 to 2.2.0-beta9, 2.3.0-beta1 to 2.3.0-beta1, 2.3.0-beta10 to 2.3.0-beta10, 2.3.0-beta11 to 2.3.0-beta11, 2.3.0-beta2 to 2.3.0-beta2, 2.3.0-beta3 to 2.3.0-beta3, 2.3.0-beta4 to 2.3.0-beta4, 2.3.0-beta5 to 2.3.0-beta5, 2.3.0-beta6 to 2.3.0-beta6, 2.3.0-beta7 to 2.3.0-beta7, 2.3.0-beta8 to 2.3.0-beta8, 2.3.0-beta9 to 2.3.0-beta9, 2.4.0-beta1 to 2.4.0-beta1, 2.4.0-beta10 to 2.4.0-beta10, 2.4.0-beta11 to 2.4.0-beta11, 2.4.0-beta2 to 2.4.0-beta2, 2.4.0-beta3 to 2.4.0-beta3, 2.4.0-beta4 to 2.4.0-beta4, 2.4.0-beta5 to 2.4.0-beta5, 2.4.0-beta6 to 2.4.0-beta6, 2.4.0-beta7 to 2.4.0-beta7, 2.4.0-beta8 to 2.4.0-beta8, 2.4.0-beta9 to 2.4.0-beta9, 2.5.0-beta1 to 2.5.0-beta1, 2.5.0-beta2 to 2.5.0-beta2, 2.5.0-beta3 to 2.5.0-beta3, 2.5.0-beta4 to 2.5.0-beta4, 2.5.0-beta5 to 2.5.0-beta5, 2.5.0-beta6 to 2.5.0-beta6, 2.5.0-beta7 to 2.5.0-beta7, 2.6.0-beta1 to 2.6.0-beta1, 2.6.0-beta2 to 2.6.0-beta2, 2.6.0-beta3 to 2.6.0-beta3, 2.6.0-beta4 to 2.6.0-beta4, 2.6.0-beta5 to 2.6.0-beta5, 2.6.0-beta6 to 2.6.0-beta6, 2.7.0-beta1 to 2.7.0-beta1, 2.7.0-beta2 to 2.7.0-beta2, 2.7.0-beta3 to 2.7.0-beta3, 2.7.0-beta4 to 2.7.0-beta4, 2.7.0-beta5 to 2.7.0-beta5, 2.7.0-beta6 to 2.7.0-beta6, 2.7.0-beta7 to 2.7.0-beta7, 2.7.0-beta8 to 2.7.0-beta8, 2.7.0-beta9 to 2.7.0-beta9, 2.8.0-beta1 to 2.8.0-beta1, 2.8.0-beta10 to 2.8.0-beta10, 2.8.0-beta11 to 2.8.0-beta11, 2.8.0-beta2 to 2.8.0-beta2, 2.8.0-beta3 to 2.8.0-beta3, 2.8.0-beta4 to 2.8.0-beta4, 2.8.0-beta5 to 2.8.0-beta5, 2.8.0-beta6 to 2.8.0-beta6, 2.8.0-beta7 to 2.8.0-beta7, 2.8.0-beta8 to 2.8.0-beta8, 2.8.0-beta9 to 2.8.0-beta9, 2.9.0-beta1 to 2.9.0-beta1, 2.9.0-beta10 to 2.9.0-beta10, 2.9.0-beta11 to 2.9.0-beta11, 2.9.0-beta12 to 2.9.0-beta12, 2.9.0-beta13 to 2.9.0-beta13, 2.9.0-beta14 to 2.9.0-beta14, 2.9.0-beta2 to 2.9.0-beta2, 2.9.0-beta3 to 2.9.0-beta3, 2.9.0-beta4 to 2.9.0-beta4, 2.9.0-beta5 to 2.9.0-beta5, 2.9.0-beta6 to 2.9.0-beta6, 2.9.0-beta7 to 2.9.0-beta7, 2.9.0-beta8 to 2.9.0-beta8, 2.9.0-beta9 to 2.9.0-beta9, 3.0.0-beta15 to 3.0.0-beta15, 3.0.0-beta16 to 3.0.0-beta16, 3.1.0-beta1 to 3.1.0-beta1, 3.1.0-beta2 to 3.1.0-beta2, 3.1.0-beta3 to 3.1.0-beta3, 3.1.0-beta5 to 3.1.0-beta5, 3.1.0-beta6 to 3.1.0-beta6 | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-37467 is a medium vulnerability (CVSS 6.8) in Discourse, published July 28, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 30th percentile. No source names a fixed version.