CVE-2022-31059: fallo de gravedad media en discourse-calendar
Discourse Calendar Event names susceptible to Cross-site Scripting
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.5epss 0.8%
Discourse Calendar is a calendar plugin for Discourse, an open-source messaging app. Prior to version 1.0.1, parsing and rendering of Event names can be susceptible to cross-site scripting (XSS) attacks. This vulnerability only affects sites which have modified or disabled Discourse’s default Content Security Policy. This issue is patched in version 1.0.1 of the Discourse Calendar plugin. As a workaround, ensure that the Content Security Policy is enabled, and has not been modified in a way which would make it more vulnerable to XSS attacks.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Productos afectados
discourse · discourse-calendarCVEs relacionadas — discourse-calendar
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-43658HIGHImproper escaping of user input in discourse-calendarEPSS 0.6%CVE-2022-41913MEDIUMDiscourse-calendar exposes members of hidden groupsEPSS 0.4%CVE-2024-24817MEDIUMUser can see invitees in events created in PMs and private categoriesEPSS 0.4%CVE-2024-26145MEDIUMUninvited user is able to join and mark the attendance of the the private eventEPSS 0.4%CVE-2024-21658MEDIUMInsufficient control of region value length in discourse-calendarEPSS 0.4%CVE-2024-45303MEDIUMDiscourse Calendar plugin event names susceptible to XSSEPSS 0.3%