CVE-2024-21658: fallo de gravedad media en discourse-calendar
Insufficient control of region value length in discourse-calendar
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 4.3epss 0.4%
discourse-calendar is a discourse plugin which adds the ability to create a dynamic calendar in the first post of a topic. The limit on region value length is too generous. This allows a malicious actor to cause a Discourse instance to use excessive bandwidth and disk space. This issue has been patched in main the main branch. There are no workarounds for this vulnerability. Please upgrade as soon as possible.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Productos afectados
discourse · discourse-calendarCVEs relacionadas — discourse-calendar
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-31059MEDIUMDiscourse Calendar Event names susceptible to Cross-site ScriptingEPSS 0.8%CVE-2023-43658HIGHImproper escaping of user input in discourse-calendarEPSS 0.6%CVE-2022-41913MEDIUMDiscourse-calendar exposes members of hidden groupsEPSS 0.4%CVE-2024-24817MEDIUMUser can see invitees in events created in PMs and private categoriesEPSS 0.4%CVE-2024-26145MEDIUMUninvited user is able to join and mark the attendance of the the private eventEPSS 0.4%CVE-2024-45303MEDIUMDiscourse Calendar plugin event names susceptible to XSSEPSS 0.3%