CVE-2023-43657

    Dashboard / Vulnerabilities / CVE-2023-43657

    CVE-2023-43657

    Published: 28 Sept 2023Last Modified: 12 Aug 2026

    Summary: Improper escaping of encrypted topic titles can lead to Cross-site Scripting under non-default site configuration

    Details: discourse-encrypt is a plugin that provides a secure communication channel through Discourse. Improper escaping of encrypted topic titles could lead to a cross site scripting (XSS) issue when a site has content security policy (CSP) headers disabled. Having CSP disabled is a non-default configuration, and having it disabled with discourse-encrypt installed will result in a warning in the Discourse admin dashboard. This has been fixed in commit `9c75810af9` which is included in the latest version of the discourse-encrypt plugin. Users are advised to upgrade. Users unable to upgrade should ensure that CSP headers are enabled and properly configured.

    References: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/43xxx/CVE-2023-43657.json, https://github.com/discourse/discourse-encrypt/security/advisories/GHSA-5fh6-wp7p-xx7v, https://nvd.nist.gov/vuln/detail/CVE-2023-43657, https://github.com/discourse/discourse-encrypt/commit/9c75810af9a474d7edaec67dea66f852c0ba1f4e

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -9c75810af9a474d7edaec67dea66f852c0ba1f4e

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-43657 | CVE-DB