CVE-2024-24817

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Discourse Calendar adds the ability to create a dynamic calendar in the first post of a topic on the open-source discussion platform Discourse. Prior to version 0.4, event invitees created in topics in private categories or PMs (private messages) can be retrieved by anyone, even if they're not logged in. This problem is resolved in version 0.4 of the discourse-calendar plugin. While no known workaround is available, putting the site behind `login_required` will disallow this endpoint to be used by anonymous users, but logged in users can still get the list of invitees in the private topics.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Feb 22, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-248185.9EspoCRM is an Open Source Customer Relationship Management software. An attacker can inject arbitrary IP or domain in "Password Change" pageCVE-2024-248198.8icingaweb2-module-incubator is a working project of bleeding edge Icinga Web 2 libraries. In affected versions the class `gipfl\Web\Form` isCVE-2024-24823.7A vulnerability has been found in Surya2Developer Hostel Management Service 1.0 and classified as problematic. Affected by this vulnerabilitCVE-2024-248208.3Icinga Director is a tool designed to make Icinga 2 configuration handling easy. Not any of Icinga Director's configuration forms used to maCVE-2024-248217.8Composer is a dependency Manager for the PHP language. In affected versions several files within the local working directory are included duCVE-2024-248229.1Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Prior to version 1.3.3, an attacker can create, delete etc. taCVE-2024-248234.4Graylog is a free and open log management platform. Starting in version 4.3.0 and prior to versions 5.1.11 and 5.2.4, reauthenticating with CVE-2024-248248.8Graylog is a free and open log management platform. Starting in version 2.0.0 and prior to versions 5.1.11 and 5.2.4, arbitrary classes can CVE-2024-248257.5DIRAC is a distributed resource framework. In affected versions any user could get a token that has been requested by another user/agent. ThCVE-2024-248265.0Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds CVE-2024-248277.5Discourse is an open source platform for community discussion. Without a rate limit on the POST /uploads endpoint, it makes it easier for anCVE-2024-248287.8pkg is tool design to bundle Node.js projects into an executables. Any native code packages built by `pkg` are written to a hardcoded direct