CVE-2024-43792

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

H

alo is an open source website building tool. A security vulnerability has been identified in versions prior to 2.17.0 of the Halo project. This vulnerability allows an attacker to execute malicious scripts in the user's browser through specific HTML and JavaScript code, potentially leading to a Cross-Site Scripting (XSS) attack. Users are advised to upgrade to version 2.17.0+. There are no known workarounds for this vulnerability.

References

Link	Resource
https://github.com/halo-dev/halo/security/advisories/GHSA-x3rj-3x75-vw4g	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:halo:halo:*:*:*:*:*:*:*:*

History

16 Sep 2024, 16:26

Type	Values Removed	Values Added
First Time		Halo halo Halo
References	~~() https://github.com/halo-dev/halo/security/advisories/GHSA-x3rj-3x75-vw4g -~~	() https://github.com/halo-dev/halo/security/advisories/GHSA-x3rj-3x75-vw4g - Exploit, Vendor Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~6.3~~	v2 : unknown v3 : 6.1
CPE		cpe:2.3:a:halo:halo::::::::

03 Sep 2024, 12:59

Type	Values Removed	Values Added
Summary		(es) Halo es una herramienta de código abierto para crear sitios web. Se ha identificado una vulnerabilidad de seguridad en versiones anteriores a la 2.17.0 del proyecto Halo. Esta vulnerabilidad permite a un atacante ejecutar secuencias de comandos maliciosas en el navegador del usuario a través de código HTML y JavaScript específico, lo que puede provocar un ataque de Cross-site Scripting (XSS). Se recomienda a los usuarios que actualicen a la versión 2.17.0+. No se conocen workarounds para esta vulnerabilidad.

02 Sep 2024, 18:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-09-02 18:15

Updated : 2024-09-16 16:26

NVD link : CVE-2024-43792

Mitre link : CVE-2024-43792

CVE.ORG link : CVE-2024-43792

JSON object : View

Products Affected

halo

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2024-43792", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.8}]}, "published": "2024-09-02T18:15:35.807", "references": [{"url": "https://github.com/halo-dev/halo/security/advisories/GHSA-x3rj-3x75-vw4g", "tags": ["Exploit", "Vendor Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Halo is an open source website building tool. A security vulnerability has been identified in versions prior to 2.17.0 of the Halo project. This vulnerability allows an attacker to execute malicious scripts in the user's browser through specific HTML and JavaScript code, potentially leading to a Cross-Site Scripting (XSS) attack. Users are advised to upgrade to version 2.17.0+. There are no known workarounds for this vulnerability."}, {"lang": "es", "value": "Halo es una herramienta de c\u00f3digo abierto para crear sitios web. Se ha identificado una vulnerabilidad de seguridad en versiones anteriores a la 2.17.0 del proyecto Halo. Esta vulnerabilidad permite a un atacante ejecutar secuencias de comandos maliciosas en el navegador del usuario a trav\u00e9s de c\u00f3digo HTML y JavaScript espec\u00edfico, lo que puede provocar un ataque de Cross-site Scripting (XSS). Se recomienda a los usuarios que actualicen a la versi\u00f3n 2.17.0+. No se conocen workarounds para esta vulnerabilidad."}], "lastModified": "2024-09-16T16:26:18.063", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:halo:halo:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1F0A843B-5A28-4D3B-BBCD-CA5BE1EAD754", "versionEndExcluding": "2.17.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}