CVE-2022-39232 - CVE House

Back to Database

Status published Medium CVE-2022-39232

Discourse vulnerable to incomplete quote causing a topic to crash in the browser

6.5 CVSS

Vulnerability Description

Discourse is an open source discussion platform. Starting with version 2.9.0.beta5 and prior to version 2.9.0.beta10, an incomplete quote can generate a JavaScript error which will crash the current page in the browser in some cases. Version 2.9.0.beta10 added a fix and tests to ensure incomplete quotes won't break the app. As a workaround, the quote can be fixed via the rails console.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-39232

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from discourse

View All →

Discourse has insecure default configuration that allows non-admin moderators to takeover any non-staff account via email change

Discourse moderators can access admin-only reports exposing private upload URLs

Discourse Has Denial of Service (DoS) Vulnerability in Drafts Creation Endpoint

Discourse non-admin moderators can exfiltrate private content via post ownership transfer

Discourse users archives leaked to users with moderation privileges

Affected Vendor

discourse

View all reports →

Affected Software

discourse

Vulnerable Versions:

>= 2.9.0.beta5, < 2.9.0.beta10

Timeline

Official Publish: September 29th, 2022

Last Modified: April 23rd, 2025

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1213 Data from Information Repositories

T1565.002 Stored Data Manipulation