CVE-2023-43658: Improper escaping of user input in discourse-calendar
dicourse-calendar is a plugin for the Discourse messaging platform which adds the ability to create a dynamic calendar in the first post of a topic. Improper escaping of event titles could lead to Cross-site Scripting (XSS) within the 'email preview' UI when a site has CSP disabled. Having CSP disabled is a non-default configuration, so the vast majority of sites are unaffected. This problem is resolved in the latest version of the discourse-calendar plugin. Users are advised to upgrade. Users unable to upgrade should ensure CSP is enabled on the forum.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-43658.
What is the severity of CVE-2023-43658?
The severity of CVE-2023-43658 is high with a CVSS score of 6.1.
What is dicourse-calendar?
dicourse-calendar is a plugin for the Discourse messaging platform which adds the ability to create a dynamic calendar in the first post of a topic.
What is the impact of this vulnerability?
The impact of this vulnerability is Cross-site Scripting (XSS) within the 'email preview' UI when a site has CSP disabled.
How can I fix CVE-2023-43658?
To fix CVE-2023-43658, it is recommended to upgrade dicourse-calendar plugin to the latest version that includes the fix.