Cross-Site Scripting Vulnerability in Discourse Calendar Plugin
CVE-2024-45303

6.1MEDIUM

Key Information:

Vendor
Discourse
Status
Calendar
Vendor
CVE Published:
12 September 2024

Summary

The Discourse Calendar plugin enables users to create interactive calendars in discussion topics. However, a vulnerability in versions prior to 0.5 allows attackers to perform Cross-Site Scripting (XSS) attacks through event names if the site's default Content Security Policy (CSP) is modified or disabled. This could lead to unauthorized script execution in the context of a user's session, making it imperative for site administrators to update to the patched version to safeguard against such attacks.

References

https://github.com/discourse/discourse-calendar/security/...
https://github.com/discourse/discourse-calendar/commit/81...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.