Discourse Mermaid (discourse-mermaid-theme-component) allows users of Discourse, open-source forum software, to create graphs using the Mermaid syntax. Users of discourse-mermaid-theme-component version 1.0.0 who can create posts are able to inject arbitrary HTML on that post. The issue has been fixed on the `main` branch of the GitHub repository, with 1.1.0 named as a patched version. Admins can update the theme component through the admin UI. As a workaround, admins can temporarily disable discourse-mermaid-theme-component.
References
Link | Resource |
---|---|
https://github.com/discourse/discourse-mermaid-theme-component/commit/c10bc4a08bf865cee20e5d5dffba535762813f0f | Patch Third Party Advisory |
https://github.com/discourse/discourse-mermaid-theme-component/pull/14 | Patch Third Party Advisory |
https://github.com/discourse/discourse-mermaid-theme-component/security/advisories/GHSA-8437-hgcm-p3q3 | Third Party Advisory |
Configurations
History
10 Jan 2023, 19:43
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:discourse:mermaid:*:*:*:*:*:*:*:* | |
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
First Time |
Discourse
Discourse mermaid |
|
CWE | CWE-79 | |
References | (MISC) https://github.com/discourse/discourse-mermaid-theme-component/commit/c10bc4a08bf865cee20e5d5dffba535762813f0f - Patch, Third Party Advisory | |
References | (MISC) https://github.com/discourse/discourse-mermaid-theme-component/pull/14 - Patch, Third Party Advisory | |
References | (MISC) https://github.com/discourse/discourse-mermaid-theme-component/security/advisories/GHSA-8437-hgcm-p3q3 - Third Party Advisory |
04 Jan 2023, 17:42
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2023-01-04 17:15
Updated : 2023-12-10 14:48
NVD link : CVE-2022-46180
Mitre link : CVE-2022-46180
CVE.ORG link : CVE-2022-46180
JSON object : View
Products Affected
discourse
- mermaid