Vulnerability · Published Oct 16, 2023 · Assigned by GitHub_M
CVE-2023-43658Improper escaping of user input in discourse-calendar
High 8.0
In plain English
A high-severity cross-site scripting in discourse-calendar from discourse. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).
Official description
dicourse-calendar is a plugin for the Discourse messaging platform which adds the ability to create a dynamic calendar in the first post of a topic. Improper escaping of event titles could lead to Cross-site Scripting (XSS) within the 'email preview' UI when a site has CSP disabled. Having CSP disabled is a non-default configuration, so the vast majority of sites are unaffected. This problem is resolved in the latest version of the discourse-calendar plugin. Users are advised to upgrade. Users unable to upgrade should ensure CSP is enabled on the forum.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| discourse | discourse-calendar | < 97883109 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H