Medium severity · published Sep 12, 2024
CVE-2024-45303
Discourse Calendar plugin adds the ability to create a dynamic calendar in the first post of a topic to Discourse
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
Discourse Calendar plugin adds the ability to create a dynamic calendar in the first post of a topic to Discourse. Rendering event names can be susceptible to XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse’s default Content Security Policy. The issue is patched in version 0.5 of the Discourse Calendar plugin.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
Calendar · Discourse
before 0.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-45303
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-45303
Patch
https://github.com/discourse/discourse-calendar/commit/81e1c8e3c4c02276fb890da7e3f684259aeb685c
Vendor Advisory
https://github.com/discourse/discourse-calendar/security/advisories/GHSA-rq37-8pf3-4xc8
More from Calendar
5.4
CVE-2022-41913
Discourse-calendar is a plugin for the Discourse messaging platform which adds the ability to create a dynamic calendar in the first post of a topic
5.3
CVE-2024-24817
Discourse Calendar adds the ability to create a dynamic calendar in the first post of a topic on the open-source discussion platform Discourse
4.3
CVE-2024-26145
Discourse Calendar adds the ability to create a dynamic calendar in the first post of a topic on Discourse