Vulnerability · Published Sep 2, 2024 · Assigned by GitHub_M

CVE-2024-43792Halo's editor has a stored Cross-Site Scripting vulnerability

Medium 6.3

In plain English

A medium-severity cross-site scripting in halo from halo-dev. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.4%top 71.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Halo is an open source website building tool. A security vulnerability has been identified in versions prior to 2.17.0 of the Halo project. This vulnerability allows an attacker to execute malicious scripts in the user's browser through specific HTML and JavaScript code, potentially leading to a Cross-Site Scripting (XSS) attack. Users are advised to upgrade to version 2.17.0+. There are no known workarounds for this vulnerability.

Affected products (as reported)

Vendor	Product	Versions
halo-dev	halo	< 2.17.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

References

https://github.com/halo-dev/halo/security/advisories/GHSA-x3rj-3x75-vw4g x_refsource_CONFIRM