CVE-2024-58353

Katalog CVE

CVSS 8.9 · High EPSS 0,42%

Kerentanan Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS). Skor CVSS 3.1 8.9 (High) menurut vulncheck.com.

Deskripsi (NVD)

Cal.com (repository calcom/cal.diy) in versions <= 4.7.15 is vulnerable to cross-site scripting (XSS) on the publicly accessible single booking view (e.g., /booking/<id>). Booking question (form field) labels are rendered via React's dangerouslySetInnerHTML without proper input sanitization or CSP, so an attacker who can create an event type with a malicious booking question label can inject arbitrary HTML/JavaScript that executes when a victim visits the booking view URL. Self-hosted instances with open registration are particularly at risk. The issue is fixed in version 4.7.16.

Rincian

Terbit di NVD

23 Juli 2026

Terakhir diubah

30 Juli 2026

Status NVD

Deferred

CVSS 3.1

8.9 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

EPSS (30 hari)

0,42% peluang dieksploitasi; lebih tinggi dari 34,0% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/calcom/cal.diy/commit/00689fda0a30b8f933c096f02c1fe092a4206def
• https://github.com/calcom/cal.diy/security/advisories/GHSA-vgj7-76cw-h6f8
• https://www.vulncheck.com/advisories/cal-com-through-cross-site-scripting-via-booking-questions