CVE-2024-21658: Insufficient control of region value length in discourse-calendar
discourse-calendar is a discourse plugin which adds the ability to create a dynamic calendar in the first post of a topic. The limit on region value length is too generous. This allows a malicious actor to cause a Discourse instance to use excessive bandwidth and disk space. This issue has been patched in main the main branch. There are no workarounds for this vulnerability. Please upgrade as soon as possible.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-21658?
CVE-2024-21658 is categorized as a medium severity vulnerability due to its potential to cause excessive bandwidth and disk space usage.
How do I fix CVE-2024-21658?
To fix CVE-2024-21658, you should update the Discourse Calendar plugin to a version released after August 28, 2024.
What kind of issues can CVE-2024-21658 cause on my Discourse instance?
CVE-2024-21658 can lead to increased bandwidth consumption and disk space exhaustion due to overly generous region value limits.
Is CVE-2024-21658 specific to certain versions of the Discourse Calendar plugin?
Yes, CVE-2024-21658 affects all versions of the Discourse Calendar plugin prior to the version released on August 28, 2024.
Who is affected by CVE-2024-21658?
Any Discourse instance using the vulnerable versions of the Discourse Calendar plugin is at risk from CVE-2024-21658.