PT-2022-20497 · Discourse · Discourse Calendar

Jomaxro · Published 2022-06-14 · Updated 2022-06-23 · CVE-2022-31059

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Discourse Calendar versions prior to 1.0.1

Description The issue affects the Discourse Calendar plugin for Discourse, an open-source messaging app, where parsing and rendering of Event names can be susceptible to cross-site scripting (XSS) attacks. This vulnerability only affects sites which have modified or disabled Discourse’s default Content Security Policy.

Recommendations For versions prior to 1.0.1, update to version 1.0.1 of the Discourse Calendar plugin to resolve the issue. As a temporary workaround, ensure that the Content Security Policy is enabled, and has not been modified in a way which would make it more vulnerable to XSS attacks.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-31059

GHSA-C783-X9VM-XXP5

Affected Products

Discourse Calendar

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31059.json · Exploit
• https://github.com/discourse/discourse-calendar/commit/2719b9e81994e961bf8c4e12b4556dc9777dd62f · Patch
• https://github.com/discourse/discourse-calendar/pull/280 · Patch
• https://osv.dev/vulnerability/CVE-2022-31059 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31059 · Security Note
• https://github.com/discourse/discourse-calendar/security/advisories/GHSA-c783-x9vm-xxp5 · Note
• https://t.me/cibsecurity/44461 · Telegram Post
• https://t.me/cvenotify/31612 · Telegram Post