Medium severity · published Jun 14, 2022
CVE-2022-31059
Discourse Calendar is a calendar plugin for Discourse, an open-source messaging app
5.4
CVSS
0.8%
EPSS
No
On KEV
Description
Discourse Calendar is a calendar plugin for Discourse, an open-source messaging app. Prior to version 1.0.1, parsing and rendering of Event names can be susceptible to cross-site scripting (XSS) attacks. This vulnerability only affects sites which have modified or disabled Discourse’s default Content Security Policy. This issue is patched in version 1.0.1 of the Discourse Calendar plugin. As a workaround, ensure that the Content Security Policy is enabled, and has not been modified in a way which would make it more vulnerable to XSS attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DC
Discourse Calendar · Discourse
before 1.0.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-31059
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-31059
Patch
https://github.com/discourse/discourse-calendar/commit/2719b9e81994e961bf8c4e12b4556dc9777dd62f
Issue Tracking
https://github.com/discourse/discourse-calendar/pull/280
Third Party Advisory
https://github.com/discourse/discourse-calendar/security/advisories/GHSA-c783-x9vm-xxp5
More from Discourse Calendar
6.1
CVE-2023-43658
dicourse-calendar is a plugin for the Discourse messaging platform which adds the ability to create a dynamic calendar in the first post of a topic
4.3
CVE-2024-21658
discourse-calendar is a discourse plugin which adds the ability to create a dynamic calendar in the first post of a topic