Medium severity · published Aug 30, 2024
CVE-2024-21658
discourse-calendar is a discourse plugin which adds the ability to create a dynamic calendar in the first post of a topic
4.3
CVSS
0.4%
EPSS
No
On KEV
Description
discourse-calendar is a discourse plugin which adds the ability to create a dynamic calendar in the first post of a topic. The limit on region value length is too generous. This allows a malicious actor to cause a Discourse instance to use excessive bandwidth and disk space. This issue has been patched in main the main branch. There are no workarounds for this vulnerability. Please upgrade as soon as possible.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DC
Discourse Calendar · Discourse
before 2024-08-28 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-21658
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-21658
Vendor Advisory
https://github.com/discourse/discourse-calendar/security/advisories/GHSA-65f2-9ghp-x8h8
More from Discourse Calendar
6.1
CVE-2023-43658
dicourse-calendar is a plugin for the Discourse messaging platform which adds the ability to create a dynamic calendar in the first post of a topic
5.4
CVE-2022-31059
Discourse Calendar is a calendar plugin for Discourse, an open-source messaging app