VulnerabilityAnalyzed

CVE-2024-45303

Rendering event names can be susceptible to XSS attacks.

MEDIUM 6.1EPSS 0.26%

Does this matter?

Lower severity and a low EPSS score (0.26%). Track it; it rarely justifies an emergency change on its own.

Description

Discourse Calendar plugin adds the ability to create a dynamic calendar in the first post of a topic to Discourse. Rendering event names can be susceptible to XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse’s default Content Security Policy. The issue is patched in version 0.5 of the Discourse Calendar plugin.

CVSS 3.1: 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.26% probability · 17th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: discourse/calendar
Source: security-advisories@github.com

References

https://github.com/discourse/discourse-calendar/commit/81e1c8e3c4c02276fb890da7e3f684259aeb685cPatch
https://github.com/discourse/discourse-calendar/security/advisories/GHSA-rq37-8pf3-4xc8Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.