CVE-2024-45303

6.1MEDIUM

Key Information:

Vendor
Discourse
Status
Calendar
Vendor
CVE Published:
12 September 2024

Summary

Discourse Calendar plugin adds the ability to create a dynamic calendar in the first post of a topic to Discourse. Rendering event names can be susceptible to XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse’s default Content Security Policy. The issue is patched in version 0.5 of the Discourse Calendar plugin.

References

https://github.com/discourse/discourse-calendar/security/...
https://github.com/discourse/discourse-calendar/commit/81...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.