Medium severity · published Sep 12, 2024
CVE-2024-45303
Discourse Calendar plugin event names susceptible to XSS
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
Discourse Calendar plugin adds the ability to create a dynamic calendar in the first post of a topic to Discourse. Rendering event names can be susceptible to XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse’s default Content Security Policy. The issue is patched in version 0.5 of the Discourse Calendar plugin.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DI
discourse-calendar · discourse
< 0.5 · source: vendor
CA
Calendar · Discourse
before 0.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-45303
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-45303
Patch
https://github.com/discourse/discourse-calendar/commit/81e1c8e3c4c02276fb890da7e3f684259aeb685c
Vendor Advisory
https://github.com/discourse/discourse-calendar/security/advisories/GHSA-rq37-8pf3-4xc8
More from discourse-calendar
6.1
CVE-2023-43658
Improper escaping of user input in discourse-calendar
5.4
CVE-2022-31059
Discourse Calendar is a calendar plugin for Discourse, an open-source messaging app
5.3
CVE-2024-24817
User can see invitees in events created in PMs and private categories
4.3
CVE-2024-21658
Insufficient control of region value length in discourse-calendar
4.3
CVE-2024-26145
Uninvited user is able to join and mark the attendance of the the private event