What is CVE-2024-43408?

CVE-2024-43408 is a medium-severity vulnerability in Discourse Discourse-Placeholder-Theme-Component, classified under Cross-site Scripting. CVSS score: 6.3/10. Published 2024-08-20.

How severe is CVE-2024-43408?

Medium severity. CVSS v3 base score is 6.3 out of 10.

Is CVE-2024-43408 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

XSS in Discourse Discourse-Placeholder-Theme-Component

CVE-2024-43408

Discourse Placeholder Forms will let you build dynamic documentation. Unsanitized and stored user input was injected in the html of the post. The vulnerability is fixed in commit a62f711d5600e4e5d86f342d52932cb6221672e7.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.002 (15.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L.

Affected products

Discourse Discourse-placeholder-theme-component — versions < a62f711d5600e4e5d86f342d52932cb6221672e7

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2024-43408?: CVE-2024-43408 is a medium-severity vulnerability in Discourse Discourse-Placeholder-Theme-Component, classified under Cross-site Scripting. CVSS score: 6.3/10. Published 2024-08-20.
How severe is CVE-2024-43408?: Medium severity. CVSS v3 base score is 6.3 out of 10.
Is CVE-2024-43408 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.