CVE-2023-43657 is a cross-site scripting (XSS) vulnerability affecting the discourse-encrypt plugin for Discourse, stemming from improper escaping of encrypted topic titles. This medium-severity flaw (CVSS 6.1) requires a non-default configuration where Content Security Policy (CSP) headers are disabled, which triggers an admin dashboard warning. While no active exploitation, public exploit code, or significant community discussion has been observed, the vulnerability could lead to limited impact on confidentiality and integrity if exploited. Users are advised to upgrade the plugin or ensure CSP headers are enabled and properly configured as a mitigation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2023-09-28CPE matchmatch criteria | cpe:2.3:a:discourse:discourse-encrypt:*:*:*:*:*:discourse:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.