CVE-2024-45303: Discourse Calendar plugin event names susceptible to XSS
Discourse Calendar plugin adds the ability to create a dynamic calendar in the first post of a topic to Discourse. Rendering event names can be susceptible to XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse’s default Content Security Policy. The issue is patched in version 0.5 of the Discourse Calendar plugin.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45303?
CVE-2024-45303 is classified as a medium severity vulnerability due to its potential for XSS attacks.
How do I fix CVE-2024-45303?
To fix CVE-2024-45303, update the Discourse Calendar plugin to a version higher than 0.5.
Who is affected by CVE-2024-45303?
CVE-2024-45303 affects Discourse sites that have modified or disabled the default Content Security Policy.
What type of attacks can CVE-2024-45303 lead to?
CVE-2024-45303 can lead to cross-site scripting (XSS) attacks if exploited.
When was CVE-2024-45303 reported?
CVE-2024-45303 was reported in 2024 and is related to vulnerabilities in the Discourse Calendar plugin.