CVE-2024-21658: discourse calendar

csirt@kutim:~/threat-intel/cve/CVE-2024-21658

CVSS 4.3 · Medium EPSS 0,36%

Kerentanan Uncontrolled Resource Consumption pada discourse calendar. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

discourse-calendar is a discourse plugin which adds the ability to create a dynamic calendar in the first post of a topic. The limit on region value length is too generous. This allows a malicious actor to cause a Discourse instance to use excessive bandwidth and disk space. This issue has been patched in main the main branch. There are no workarounds for this vulnerability. Please upgrade as soon as possible.

Rincian

Terbit di NVD: 30 Agustus 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-400: Uncontrolled Resource Consumption
CWE-770: Allocation of Resources Without Limits or Throttling
EPSS (30 hari): 0,36% peluang dieksploitasi; lebih tinggi dari 28,1% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
discourse	discourse calendar	Semua versi sebelum 2024-08-28

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/discourse/discourse-calendar/security/advisories/GHSA-65f2-9ghp-x8h8 advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.