CVE-2024-43792: Halo's editor has a stored Cross-Site Scripting vulnerability
Halo is an open source website building tool. A security vulnerability has been identified in versions prior to 2.17.0 of the Halo project. This vulnerability allows an attacker to execute malicious scripts in the user's browser through specific HTML and JavaScript code, potentially leading to a Cross-Site Scripting (XSS) attack. Users are advised to upgrade to version 2.17.0+. There are no known workarounds for this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-43792?
CVE-2024-43792 is classified as a high-severity vulnerability due to its potential for allowing remote code execution in a user's browser.
How do I fix CVE-2024-43792?
To mitigate CVE-2024-43792, users should upgrade to Halo version 2.17.0 or later.
What impact does CVE-2024-43792 have on users?
CVE-2024-43792 can allow attackers to execute malicious scripts in the browser of users visiting an affected Halo website.
Which versions of Halo are affected by CVE-2024-43792?
CVE-2024-43792 affects all Halo versions prior to 2.17.0.
Is there a known exploit for CVE-2024-43792?
While the specifics of the exploit are not detailed, CVE-2024-43792 allows attackers to run malicious scripts, indicating the potential for existing exploitation techniques.