CVE-2023-37467

Discourse is an open source discussion platform. Prior to version 3.1.0.beta7 of the `beta` and `tests-passed` branches, a CSP (Content Security Policy) nonce reuse vulnerability was discovered could allow cross-site scripting (XSS) attacks to bypass CSP protection for anonymous (i.e. unauthenticated) users. There are no known XSS vectors at the moment, but should one be discovered, this vulnerability would allow the XSS attack to bypass CSP and execute successfully. This vulnerability isn't applicable to logged-in users. Version 3.1.0.beta7 contains a patch. The stable branch doesn't have this vulnerability. A workaround to prevent the vulnerability is to disable Google Tag Manager, i.e., unset the `gtm container id` setting.

• CWE-323
• CWE-79

• https://github.com/discourse/discourse/commit/0976c8fad6970b6182e7837bf87de07709407f25Patch
• https://github.com/discourse/discourse/security/advisories/GHSA-gr5h-hm62-jr3jVendor Advisory
• https://github.com/discourse/discourse/commit/0976c8fad6970b6182e7837bf87de07709407f25Patch
• https://github.com/discourse/discourse/security/advisories/GHSA-gr5h-hm62-jr3jVendor Advisory

Published

Jul 28, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-37460Plexis Archiver is a collection of Plexus components to crea…9.8
• CVE-2023-37461Metersphere is an opensource testing framework. Files upload…9.8
• CVE-2023-37462XWiki Platform is a generic wiki platform offering runtime s…8.8
• CVE-2023-37463cmark-gfm is an extended version of the C reference implemen…7.5
• CVE-2023-37464OpenIDC/cjose is a C library implementing the Javascript Obj…7.5
• CVE-2023-37466vm2 is an advanced vm/sandbox for Node.js. The library conta…10
• CVE-2023-37468Feedbacksystem is a personalized feedback system for student…5.5
• CVE-2023-37469CasaOS is an open-source personal cloud system. Prior to ver…8.8
• CVE-2023-3747Zero Trust Administrators have the ability to disallow end u…5.5
• CVE-2023-37470Metabase is an open-source business intelligence and analyti…9.8
• CVE-2023-37471Open Access Management (OpenAM) is an access management solu…9.8
• CVE-2023-37472Knowage is an open source suite for business analytics. The …6.5