CVE-2024-45303

CVSS V2 None CVSS V3 None

Description

Discourse Calendar plugin adds the ability to create a dynamic calendar in the first post of a topic to Discourse. Rendering event names can be susceptible to XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse’s default Content Security Policy. The issue is patched in version 0.5 of the Discourse Calendar plugin.

Overview

CVE ID
CVE-2024-45303

Assigner
GitHub_M

Vulnerability Status
PUBLISHED

Published Version
2024-09-12T18:11:46.513Z

Last Modified Date
2024-09-12T19:55:25.980Z

Weakness Enumerations

CWE	URL
CWE-79	http://cwe.mitre.org/data/definitions/79.html

References

Reference URL	Reference Tags
https://github.com/discourse/discourse-calendar/security/advisories/GHSA-rq37-8pf3-4xc8	x_refsource_CONFIRM
https://github.com/discourse/discourse-calendar/commit/81e1c8e3c4c02276fb890da7e3f684259aeb685c	x_refsource_MISC

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2024-45303
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45303

History

Created	Old Value	New Value	Data Type	Notes
2024-09-13 13:14:37				Added to TrackCVE