CVE-2022-31059: Discourse Calendar Event names susceptible to Cross-site Scripting
Discourse Calendar is a calendar plugin for Discourse, an open-source messaging app. Prior to version 1.0.1, parsing and rendering of Event names can be susceptible to cross-site scripting (XSS) attacks. This vulnerability only affects sites which have modified or disabled Discourse’s default Content Security Policy. This issue is patched in version 1.0.1 of the Discourse Calendar plugin. As a workaround, ensure that the Content Security Policy is enabled, and has not been modified in a way which would make it more vulnerable to XSS attacks.
Other sources
Discourse Calendar is a calendar plugin for Discourse, an open-source messaging app. Prior to version 1.0.1, parsing and rendering of Event names can be susceptible to cross-site scripting (XSS) attacks. This vulnerability only affects sites which have modified or disabled Discourse’s default Content Security Policy. This issue is patched in version 1.0.1 of the Discourse Calendar plugin. As a workaround, ensure that the Content Security Policy is enabled, and has not been modified in a way which would make it more vulnerable to XSS attacks.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this Discourse Calendar vulnerability?
The vulnerability ID for this Discourse Calendar vulnerability is CVE-2022-31059.
What is the severity level of CVE-2022-31059?
The severity level of CVE-2022-31059 is medium (5.4).
How does CVE-2022-31059 impact Discourse Calendar?
CVE-2022-31059 impacts Discourse Calendar by making the parsing and rendering of event names susceptible to cross-site scripting (XSS) attacks.
Which versions of Discourse Calendar are affected by CVE-2022-31059?
Versions prior to 1.0.1 of Discourse Calendar are affected by CVE-2022-31059.
How can I fix CVE-2022-31059 in Discourse Calendar?
To fix CVE-2022-31059 in Discourse Calendar, it is recommended to update to version 1.0.1 or later of the plugin.