PT-2024-31556 · Discourse · Discourse Calendar Plugin

Pmusaraj · Published 2024-09-12 · Updated 2024-09-18 · CVE-2024-45303

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Discourse Calendar plugin versions prior to 0.5

Description The Discourse Calendar plugin is susceptible to XSS attacks when rendering event names. This issue only affects sites that have modified or disabled Discourse's default Content Security Policy.

Recommendations For versions prior to 0.5, update to version 0.5 of the Discourse Calendar plugin to resolve the issue. As a temporary workaround, consider restricting the rendering of event names or re-enabling Discourse's default Content Security Policy until the patch can be applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-45303

GHSA-RQ37-8PF3-4XC8

Affected Products

Discourse Calendar Plugin

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45303.json · Exploit
• https://github.com/discourse/discourse-calendar/commit/81e1c8e3c4c02276fb890da7e3f684259aeb685c · Patch
• https://github.com/discourse/discourse-calendar/security/advisories/GHSA-rq37-8pf3-4xc8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45303 · Security Note
• https://osv.dev/vulnerability/CVE-2024-45303 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1834336802762543259 · Twitter Post
• https://t.me/cvedetector/5520 · Telegram Post
• https://twitter.com/CVEnew/status/1834302034255765648 · Twitter Post