CVE-2024-45303: Discourse Calendar plugin event names susceptible to XSS
First published: Thu Sep 12 2024(Updated: )
Discourse Calendar plugin adds the ability to create a dynamic calendar in the first post of a topic to Discourse. Rendering event names can be susceptible to XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse’s default Content Security Policy. The issue is patched in version 0.5 of the Discourse Calendar plugin.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Discourse Calendar plugin | <0.5 |
Remedy
https://github.com/discourse/discourse-calendar/commit/81e1c8e3c4c02276fb890da7e3f684259aeb685c
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-45303?
CVE-2024-45303 is classified as a medium severity vulnerability due to its potential for XSS attacks.
How do I fix CVE-2024-45303?
To fix CVE-2024-45303, update the Discourse Calendar plugin to a version higher than 0.5.
Who is affected by CVE-2024-45303?
CVE-2024-45303 affects Discourse sites that have modified or disabled the default Content Security Policy.
What type of attacks can CVE-2024-45303 lead to?
CVE-2024-45303 can lead to cross-site scripting (XSS) attacks if exploited.
When was CVE-2024-45303 reported?
CVE-2024-45303 was reported in 2024 and is related to vulnerabilities in the Discourse Calendar plugin.
- agent/weakness
- agent/references
- agent/title
- agent/type
- agent/description
- agent/first-publish-date
- agent/author
- agent/severity
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/discourse
- canonical/discourse calendar plugin