CVE-2024-24817

Discourse Calendar adds the ability to create a dynamic calendar in the first post of a topic on the open-source discussion platform Discourse. Prior to version 0.4, event invitees created in topics in private categories or PMs (private messages) can be retrieved by anyone, even if they're not logged in. This problem is resolved in version 0.4 of the discourse-calendar plugin. While no known workaround is available, putting the site behind `login_required` will disallow this endpoint to be used by anonymous users, but logged in users can still get the list of invitees in the private topics.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/discourse/discourse-calendar/commit/84ef46a38cf02748ecacad16c5d9c6fec12dc8da
https://github.com/discourse/discourse-calendar/security/advisories/GHSA-wwq5-g5cp-c69f

Configurations

No configuration.

History

No history.

Information

Published : 2024-02-22 18:15

Updated : 2024-02-22 19:07

NVD link : CVE-2024-24817

Mitre link : CVE-2024-24817

CVE.ORG link : CVE-2024-24817

JSON object : View

Products Affected

No product.

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2024-24817", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2024-02-22T18:15:48.587", "references": [{"url": "https://github.com/discourse/discourse-calendar/commit/84ef46a38cf02748ecacad16c5d9c6fec12dc8da", "source": "security-advisories@github.com"}, {"url": "https://github.com/discourse/discourse-calendar/security/advisories/GHSA-wwq5-g5cp-c69f", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "Discourse Calendar adds the ability to create a dynamic calendar in the first post of a topic on the open-source discussion platform Discourse. Prior to version 0.4, event invitees created in topics in private categories or PMs (private messages) can be retrieved by anyone, even if they're not logged in. This problem is resolved in version 0.4 of the discourse-calendar plugin. While no known workaround is available, putting the site behind `login_required` will disallow this endpoint to be used by anonymous users, but logged in users can still get the list of invitees in the private topics."}, {"lang": "es", "value": "Discourse Calendar agrega la capacidad de crear un calendario din\u00e1mico en la primera publicaci\u00f3n de un tema en la plataforma de discusi\u00f3n de c\u00f3digo abierto Discourse. Antes de la versi\u00f3n 0.4, cualquier persona puede recuperar los invitados a eventos creados en temas en categor\u00edas privadas o MP (mensajes privados), incluso si no han iniciado sesi\u00f3n. Este problema se resuelve en la versi\u00f3n 0.4 del complemento de calendario de discurso. Si bien no hay un workaround disponible, colocar el sitio detr\u00e1s de `login_required` no permitir\u00e1 que usuarios an\u00f3nimos utilicen este endpoint, pero los usuarios que hayan iniciado sesi\u00f3n a\u00fan pueden obtener la lista de invitados en los temas privados."}], "lastModified": "2024-02-22T19:07:27.197", "sourceIdentifier": "security-advisories@github.com"}