Vulnerabilities
Misconfiguration
Compliance
CVE Vulnerabilities

CVE-2023-37467

Reusing a Nonce, Key Pair in Encryption

Published: Jul 28, 2023 | Modified: Nov 21, 2024
CVSS 3.x
5.4
MEDIUM
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu
Vulnerability-free packages from our partners
root.io logo minimus.io logo echo.ai logo
Additional information
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2023-37467
CWEhttps://cwe.mitre.org/data/definitions/323.html

Discourse is an open source discussion platform. Prior to version 3.1.0.beta7 of the beta and tests-passed branches, a CSP (Content Security Policy) nonce reuse vulnerability was discovered could allow cross-site scripting (XSS) attacks to bypass CSP protection for anonymous (i.e. unauthenticated) users. There are no known XSS vectors at the moment, but should one be discovered, this vulnerability would allow the XSS attack to bypass CSP and execute successfully. This vulnerability isnt applicable to logged-in users. Version 3.1.0.beta7 contains a patch. The stable branch doesnt have this vulnerability. A workaround to prevent the vulnerability is to disable Google Tag Manager, i.e., unset the gtm container id setting.

Weakness

Nonces should be used for the present occasion and only once.

Affected Software

NameVendorStart VersionEnd Version
DiscourseDiscourse1.1.0-beta1 (including)1.1.0-beta1 (including)
DiscourseDiscourse1.1.0-beta2 (including)1.1.0-beta2 (including)
DiscourseDiscourse1.1.0-beta3 (including)1.1.0-beta3 (including)
DiscourseDiscourse1.1.0-beta4 (including)1.1.0-beta4 (including)
DiscourseDiscourse1.1.0-beta5 (including)1.1.0-beta5 (including)
DiscourseDiscourse1.1.0-beta6 (including)1.1.0-beta6 (including)
DiscourseDiscourse1.1.0-beta6b (including)1.1.0-beta6b (including)
DiscourseDiscourse1.1.0-beta7 (including)1.1.0-beta7 (including)
DiscourseDiscourse1.1.0-beta8 (including)1.1.0-beta8 (including)
DiscourseDiscourse1.2.0-beta1 (including)1.2.0-beta1 (including)
DiscourseDiscourse1.2.0-beta2 (including)1.2.0-beta2 (including)
DiscourseDiscourse1.2.0-beta3 (including)1.2.0-beta3 (including)
DiscourseDiscourse1.2.0-beta4 (including)1.2.0-beta4 (including)
DiscourseDiscourse1.2.0-beta5 (including)1.2.0-beta5 (including)
DiscourseDiscourse1.2.0-beta6 (including)1.2.0-beta6 (including)
DiscourseDiscourse1.2.0-beta7 (including)1.2.0-beta7 (including)
DiscourseDiscourse1.2.0-beta8 (including)1.2.0-beta8 (including)
DiscourseDiscourse1.2.0-beta9 (including)1.2.0-beta9 (including)
DiscourseDiscourse1.3.0-beta1 (including)1.3.0-beta1 (including)
DiscourseDiscourse1.3.0-beta10 (including)1.3.0-beta10 (including)
DiscourseDiscourse1.3.0-beta11 (including)1.3.0-beta11 (including)
DiscourseDiscourse1.3.0-beta2 (including)1.3.0-beta2 (including)
DiscourseDiscourse1.3.0-beta3 (including)1.3.0-beta3 (including)
DiscourseDiscourse1.3.0-beta4 (including)1.3.0-beta4 (including)
DiscourseDiscourse1.3.0-beta5 (including)1.3.0-beta5 (including)
DiscourseDiscourse1.3.0-beta6 (including)1.3.0-beta6 (including)
DiscourseDiscourse1.3.0-beta7 (including)1.3.0-beta7 (including)
DiscourseDiscourse1.3.0-beta8 (including)1.3.0-beta8 (including)
DiscourseDiscourse1.3.0-beta9 (including)1.3.0-beta9 (including)
DiscourseDiscourse1.4.0-beta1 (including)1.4.0-beta1 (including)
DiscourseDiscourse1.4.0-beta10 (including)1.4.0-beta10 (including)
DiscourseDiscourse1.4.0-beta11 (including)1.4.0-beta11 (including)
DiscourseDiscourse1.4.0-beta12 (including)1.4.0-beta12 (including)
DiscourseDiscourse1.4.0-beta2 (including)1.4.0-beta2 (including)
DiscourseDiscourse1.4.0-beta3 (including)1.4.0-beta3 (including)
DiscourseDiscourse1.4.0-beta4 (including)1.4.0-beta4 (including)
DiscourseDiscourse1.4.0-beta5 (including)1.4.0-beta5 (including)
DiscourseDiscourse1.4.0-beta6 (including)1.4.0-beta6 (including)
DiscourseDiscourse1.4.0-beta7 (including)1.4.0-beta7 (including)
DiscourseDiscourse1.4.0-beta8 (including)1.4.0-beta8 (including)
DiscourseDiscourse1.4.0-beta9 (including)1.4.0-beta9 (including)
DiscourseDiscourse1.5.0-beta1 (including)1.5.0-beta1 (including)
DiscourseDiscourse1.5.0-beta10 (including)1.5.0-beta10 (including)
DiscourseDiscourse1.5.0-beta11 (including)1.5.0-beta11 (including)
DiscourseDiscourse1.5.0-beta12 (including)1.5.0-beta12 (including)
DiscourseDiscourse1.5.0-beta13 (including)1.5.0-beta13 (including)
DiscourseDiscourse1.5.0-beta13b (including)1.5.0-beta13b (including)
DiscourseDiscourse1.5.0-beta14 (including)1.5.0-beta14 (including)
DiscourseDiscourse1.5.0-beta2 (including)1.5.0-beta2 (including)
DiscourseDiscourse1.5.0-beta3 (including)1.5.0-beta3 (including)
DiscourseDiscourse1.5.0-beta4 (including)1.5.0-beta4 (including)
DiscourseDiscourse1.5.0-beta5 (including)1.5.0-beta5 (including)
DiscourseDiscourse1.5.0-beta6 (including)1.5.0-beta6 (including)
DiscourseDiscourse1.5.0-beta7 (including)1.5.0-beta7 (including)
DiscourseDiscourse1.5.0-beta8 (including)1.5.0-beta8 (including)
DiscourseDiscourse1.5.0-beta9 (including)1.5.0-beta9 (including)
DiscourseDiscourse1.6.0-beta1 (including)1.6.0-beta1 (including)
DiscourseDiscourse1.6.0-beta10 (including)1.6.0-beta10 (including)
DiscourseDiscourse1.6.0-beta11 (including)1.6.0-beta11 (including)
DiscourseDiscourse1.6.0-beta12 (including)1.6.0-beta12 (including)
DiscourseDiscourse1.6.0-beta2 (including)1.6.0-beta2 (including)
DiscourseDiscourse1.6.0-beta3 (including)1.6.0-beta3 (including)
DiscourseDiscourse1.6.0-beta4 (including)1.6.0-beta4 (including)
DiscourseDiscourse1.6.0-beta5 (including)1.6.0-beta5 (including)
DiscourseDiscourse1.6.0-beta6 (including)1.6.0-beta6 (including)
DiscourseDiscourse1.6.0-beta7 (including)1.6.0-beta7 (including)
DiscourseDiscourse1.6.0-beta8 (including)1.6.0-beta8 (including)
DiscourseDiscourse1.6.0-beta9 (including)1.6.0-beta9 (including)
DiscourseDiscourse1.7.0-beta1 (including)1.7.0-beta1 (including)
DiscourseDiscourse1.7.0-beta10 (including)1.7.0-beta10 (including)
DiscourseDiscourse1.7.0-beta11 (including)1.7.0-beta11 (including)
DiscourseDiscourse1.7.0-beta2 (including)1.7.0-beta2 (including)
DiscourseDiscourse1.7.0-beta3 (including)1.7.0-beta3 (including)
DiscourseDiscourse1.7.0-beta4 (including)1.7.0-beta4 (including)
DiscourseDiscourse1.7.0-beta5 (including)1.7.0-beta5 (including)
DiscourseDiscourse1.7.0-beta6 (including)1.7.0-beta6 (including)
DiscourseDiscourse1.7.0-beta7 (including)1.7.0-beta7 (including)
DiscourseDiscourse1.7.0-beta8 (including)1.7.0-beta8 (including)
DiscourseDiscourse1.7.0-beta9 (including)1.7.0-beta9 (including)
DiscourseDiscourse1.8.0-beta1 (including)1.8.0-beta1 (including)
DiscourseDiscourse1.8.0-beta10 (including)1.8.0-beta10 (including)
DiscourseDiscourse1.8.0-beta11 (including)1.8.0-beta11 (including)
DiscourseDiscourse1.8.0-beta12 (including)1.8.0-beta12 (including)
DiscourseDiscourse1.8.0-beta13 (including)1.8.0-beta13 (including)
DiscourseDiscourse1.8.0-beta2 (including)1.8.0-beta2 (including)
DiscourseDiscourse1.8.0-beta3 (including)1.8.0-beta3 (including)
DiscourseDiscourse1.8.0-beta4 (including)1.8.0-beta4 (including)
DiscourseDiscourse1.8.0-beta5 (including)1.8.0-beta5 (including)
DiscourseDiscourse1.8.0-beta6 (including)1.8.0-beta6 (including)
DiscourseDiscourse1.8.0-beta7 (including)1.8.0-beta7 (including)
DiscourseDiscourse1.8.0-beta8 (including)1.8.0-beta8 (including)
DiscourseDiscourse1.8.0-beta9 (including)1.8.0-beta9 (including)
DiscourseDiscourse1.9.0-beta1 (including)1.9.0-beta1 (including)
DiscourseDiscourse1.9.0-beta10 (including)1.9.0-beta10 (including)
DiscourseDiscourse1.9.0-beta11 (including)1.9.0-beta11 (including)
DiscourseDiscourse1.9.0-beta12 (including)1.9.0-beta12 (including)
DiscourseDiscourse1.9.0-beta13 (including)1.9.0-beta13 (including)
DiscourseDiscourse1.9.0-beta14 (including)1.9.0-beta14 (including)
DiscourseDiscourse1.9.0-beta15 (including)1.9.0-beta15 (including)
DiscourseDiscourse1.9.0-beta16 (including)1.9.0-beta16 (including)
DiscourseDiscourse1.9.0-beta17 (including)1.9.0-beta17 (including)
DiscourseDiscourse1.9.0-beta2 (including)1.9.0-beta2 (including)
DiscourseDiscourse1.9.0-beta3 (including)1.9.0-beta3 (including)
DiscourseDiscourse1.9.0-beta4 (including)1.9.0-beta4 (including)
DiscourseDiscourse1.9.0-beta5 (including)1.9.0-beta5 (including)
DiscourseDiscourse1.9.0-beta6 (including)1.9.0-beta6 (including)
DiscourseDiscourse1.9.0-beta7 (including)1.9.0-beta7 (including)
DiscourseDiscourse1.9.0-beta8 (including)1.9.0-beta8 (including)
DiscourseDiscourse1.9.0-beta9 (including)1.9.0-beta9 (including)
DiscourseDiscourse2.0.0-beta1 (including)2.0.0-beta1 (including)
DiscourseDiscourse2.0.0-beta10 (including)2.0.0-beta10 (including)
DiscourseDiscourse2.0.0-beta2 (including)2.0.0-beta2 (including)
DiscourseDiscourse2.0.0-beta3 (including)2.0.0-beta3 (including)
DiscourseDiscourse2.0.0-beta4 (including)2.0.0-beta4 (including)
DiscourseDiscourse2.0.0-beta5 (including)2.0.0-beta5 (including)
DiscourseDiscourse2.0.0-beta6 (including)2.0.0-beta6 (including)
DiscourseDiscourse2.0.0-beta7 (including)2.0.0-beta7 (including)
DiscourseDiscourse2.0.0-beta8 (including)2.0.0-beta8 (including)
DiscourseDiscourse2.0.0-beta9 (including)2.0.0-beta9 (including)
DiscourseDiscourse2.1.0-beta1 (including)2.1.0-beta1 (including)
DiscourseDiscourse2.1.0-beta2 (including)2.1.0-beta2 (including)
DiscourseDiscourse2.1.0-beta3 (including)2.1.0-beta3 (including)
DiscourseDiscourse2.1.0-beta4 (including)2.1.0-beta4 (including)
DiscourseDiscourse2.1.0-beta5 (including)2.1.0-beta5 (including)
DiscourseDiscourse2.1.0-beta6 (including)2.1.0-beta6 (including)
DiscourseDiscourse2.2.0-beta1 (including)2.2.0-beta1 (including)
DiscourseDiscourse2.2.0-beta10 (including)2.2.0-beta10 (including)
DiscourseDiscourse2.2.0-beta2 (including)2.2.0-beta2 (including)
DiscourseDiscourse2.2.0-beta3 (including)2.2.0-beta3 (including)
DiscourseDiscourse2.2.0-beta4 (including)2.2.0-beta4 (including)
DiscourseDiscourse2.2.0-beta5 (including)2.2.0-beta5 (including)
DiscourseDiscourse2.2.0-beta6 (including)2.2.0-beta6 (including)
DiscourseDiscourse2.2.0-beta7 (including)2.2.0-beta7 (including)
DiscourseDiscourse2.2.0-beta8 (including)2.2.0-beta8 (including)
DiscourseDiscourse2.2.0-beta9 (including)2.2.0-beta9 (including)
DiscourseDiscourse2.3.0-beta1 (including)2.3.0-beta1 (including)
DiscourseDiscourse2.3.0-beta10 (including)2.3.0-beta10 (including)
DiscourseDiscourse2.3.0-beta11 (including)2.3.0-beta11 (including)
DiscourseDiscourse2.3.0-beta2 (including)2.3.0-beta2 (including)
DiscourseDiscourse2.3.0-beta3 (including)2.3.0-beta3 (including)
DiscourseDiscourse2.3.0-beta4 (including)2.3.0-beta4 (including)
DiscourseDiscourse2.3.0-beta5 (including)2.3.0-beta5 (including)
DiscourseDiscourse2.3.0-beta6 (including)2.3.0-beta6 (including)
DiscourseDiscourse2.3.0-beta7 (including)2.3.0-beta7 (including)
DiscourseDiscourse2.3.0-beta8 (including)2.3.0-beta8 (including)
DiscourseDiscourse2.3.0-beta9 (including)2.3.0-beta9 (including)
DiscourseDiscourse2.4.0-beta1 (including)2.4.0-beta1 (including)
DiscourseDiscourse2.4.0-beta10 (including)2.4.0-beta10 (including)
DiscourseDiscourse2.4.0-beta11 (including)2.4.0-beta11 (including)
DiscourseDiscourse2.4.0-beta2 (including)2.4.0-beta2 (including)
DiscourseDiscourse2.4.0-beta3 (including)2.4.0-beta3 (including)
DiscourseDiscourse2.4.0-beta4 (including)2.4.0-beta4 (including)
DiscourseDiscourse2.4.0-beta5 (including)2.4.0-beta5 (including)
DiscourseDiscourse2.4.0-beta6 (including)2.4.0-beta6 (including)
DiscourseDiscourse2.4.0-beta7 (including)2.4.0-beta7 (including)
DiscourseDiscourse2.4.0-beta8 (including)2.4.0-beta8 (including)
DiscourseDiscourse2.4.0-beta9 (including)2.4.0-beta9 (including)
DiscourseDiscourse2.5.0-beta1 (including)2.5.0-beta1 (including)
DiscourseDiscourse2.5.0-beta2 (including)2.5.0-beta2 (including)
DiscourseDiscourse2.5.0-beta3 (including)2.5.0-beta3 (including)
DiscourseDiscourse2.5.0-beta4 (including)2.5.0-beta4 (including)
DiscourseDiscourse2.5.0-beta5 (including)2.5.0-beta5 (including)
DiscourseDiscourse2.5.0-beta6 (including)2.5.0-beta6 (including)
DiscourseDiscourse2.5.0-beta7 (including)2.5.0-beta7 (including)
DiscourseDiscourse2.6.0-beta1 (including)2.6.0-beta1 (including)
DiscourseDiscourse2.6.0-beta2 (including)2.6.0-beta2 (including)
DiscourseDiscourse2.6.0-beta3 (including)2.6.0-beta3 (including)
DiscourseDiscourse2.6.0-beta4 (including)2.6.0-beta4 (including)
DiscourseDiscourse2.6.0-beta5 (including)2.6.0-beta5 (including)
DiscourseDiscourse2.6.0-beta6 (including)2.6.0-beta6 (including)
DiscourseDiscourse2.7.0-beta1 (including)2.7.0-beta1 (including)
DiscourseDiscourse2.7.0-beta2 (including)2.7.0-beta2 (including)
DiscourseDiscourse2.7.0-beta3 (including)2.7.0-beta3 (including)
DiscourseDiscourse2.7.0-beta4 (including)2.7.0-beta4 (including)
DiscourseDiscourse2.7.0-beta5 (including)2.7.0-beta5 (including)
DiscourseDiscourse2.7.0-beta6 (including)2.7.0-beta6 (including)
DiscourseDiscourse2.7.0-beta7 (including)2.7.0-beta7 (including)
DiscourseDiscourse2.7.0-beta8 (including)2.7.0-beta8 (including)
DiscourseDiscourse2.7.0-beta9 (including)2.7.0-beta9 (including)
DiscourseDiscourse2.8.0-beta1 (including)2.8.0-beta1 (including)
DiscourseDiscourse2.8.0-beta10 (including)2.8.0-beta10 (including)
DiscourseDiscourse2.8.0-beta11 (including)2.8.0-beta11 (including)
DiscourseDiscourse2.8.0-beta2 (including)2.8.0-beta2 (including)
DiscourseDiscourse2.8.0-beta3 (including)2.8.0-beta3 (including)
DiscourseDiscourse2.8.0-beta4 (including)2.8.0-beta4 (including)
DiscourseDiscourse2.8.0-beta5 (including)2.8.0-beta5 (including)
DiscourseDiscourse2.8.0-beta6 (including)2.8.0-beta6 (including)
DiscourseDiscourse2.8.0-beta7 (including)2.8.0-beta7 (including)
DiscourseDiscourse2.8.0-beta8 (including)2.8.0-beta8 (including)
DiscourseDiscourse2.8.0-beta9 (including)2.8.0-beta9 (including)
DiscourseDiscourse2.9.0-beta1 (including)2.9.0-beta1 (including)
DiscourseDiscourse2.9.0-beta10 (including)2.9.0-beta10 (including)
DiscourseDiscourse2.9.0-beta11 (including)2.9.0-beta11 (including)
DiscourseDiscourse2.9.0-beta12 (including)2.9.0-beta12 (including)
DiscourseDiscourse2.9.0-beta13 (including)2.9.0-beta13 (including)
DiscourseDiscourse2.9.0-beta14 (including)2.9.0-beta14 (including)
DiscourseDiscourse2.9.0-beta2 (including)2.9.0-beta2 (including)
DiscourseDiscourse2.9.0-beta3 (including)2.9.0-beta3 (including)
DiscourseDiscourse2.9.0-beta4 (including)2.9.0-beta4 (including)
DiscourseDiscourse2.9.0-beta5 (including)2.9.0-beta5 (including)
DiscourseDiscourse2.9.0-beta6 (including)2.9.0-beta6 (including)
DiscourseDiscourse2.9.0-beta7 (including)2.9.0-beta7 (including)
DiscourseDiscourse2.9.0-beta8 (including)2.9.0-beta8 (including)
DiscourseDiscourse2.9.0-beta9 (including)2.9.0-beta9 (including)
DiscourseDiscourse3.0.0-beta15 (including)3.0.0-beta15 (including)
DiscourseDiscourse3.0.0-beta16 (including)3.0.0-beta16 (including)
DiscourseDiscourse3.1.0-beta1 (including)3.1.0-beta1 (including)
DiscourseDiscourse3.1.0-beta2 (including)3.1.0-beta2 (including)
DiscourseDiscourse3.1.0-beta3 (including)3.1.0-beta3 (including)
DiscourseDiscourse3.1.0-beta5 (including)3.1.0-beta5 (including)
DiscourseDiscourse3.1.0-beta6 (including)3.1.0-beta6 (including)

Potential Mitigations

References

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2026 Aqua Security Software Ltd.   Privacy Policy | Terms of Use