What is CVE-2024-45303?

CVE-2024-45303 is a medium-severity vulnerability in Discourse Calendar, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2024-09-12.

How severe is CVE-2024-45303?

Medium severity. CVSS v3 base score is 6.1 out of 10.

XSS in Discourse Calendar

CVE-2024-45303

Discourse Calendar plugin adds the ability to create a dynamic calendar in the first post of a topic to Discourse. Rendering event names can be susceptible to XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse’s default Content Security Policy. The issue is patched in version 0.5 of the Discourse Calendar plugin.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.002 (15.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

Affected products

Discourse Calendar
Discourse Discourse-calendar — versions < 0.5

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2024-45303?: CVE-2024-45303 is a medium-severity vulnerability in Discourse Calendar, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2024-09-12.
How severe is CVE-2024-45303?: Medium severity. CVSS v3 base score is 6.1 out of 10.