PT-2024-20583 · Discourse · Discourse Calendar

0-0Eth0 + 1 · Published 2024-02-22 · Updated 2025-02-05 · CVE-2024-24817

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Discourse Calendar versions prior to 0.4

Description The issue allows event invitees created in private categories or private messages to be retrieved by anyone, even if they are not logged in. This is a problem with the Discourse Calendar plugin for the open-source discussion platform Discourse. There is no known workaround, but putting the site behind login required can disallow the use of this endpoint by anonymous users. However, logged-in users can still get the list of invitees in private topics.

Recommendations For versions prior to 0.4, update to version 0.4 of the discourse-calendar plugin to resolve the issue. As a temporary workaround, consider putting the site behind login required to disallow the use of the vulnerable endpoint by anonymous users.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-24817

GHSA-WWQ5-G5CP-C69F

Affected Products

Discourse Calendar

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24817.json · Exploit
• https://github.com/discourse/discourse-calendar/security/advisories/GHSA-wwq5-g5cp-c69f · Vendor Advisory
• https://github.com/discourse/discourse-calendar/commit/84ef46a38cf02748ecacad16c5d9c6fec12dc8da · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-24817 · Security Note
• https://osv.dev/vulnerability/CVE-2024-24817 · Vendor Advisory
• https://twitter.com/CVEnew/status/1760724288783409166 · Twitter Post
• https://t.me/cvenotify/72235 · Telegram Post
• https://t.me/cvenotify/110181 · Telegram Post