CVE-2024-43792

Halo is an open source website building tool. A security vulnerability has been identified in versions prior to 2.17.0 of the Halo project. This vulnerability allows an attacker to execute malicious scripts in the user's browser through specific HTML and JavaScript code, potentially leading to a Cross-Site Scripting (XSS) attack. Users are advised to upgrade to version 2.17.0+. There are no known workarounds for this vulnerability.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/halo-dev/halo/security/advisories/GHSA-x3rj-3x75-vw4g	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:halo:halo:*:*:*:*:*:*:*:*

History

16 Sep 2024, 16:26

Type	Values Removed	Values Added
First Time		Halo halo Halo
CVSS	v2 : ~~unknown~~ v3 : ~~6.3~~	v2 : unknown v3 : 6.1
CPE		cpe:2.3:a:halo:halo::::::::
References	~~() https://github.com/halo-dev/halo/security/advisories/GHSA-x3rj-3x75-vw4g -~~	() https://github.com/halo-dev/halo/security/advisories/GHSA-x3rj-3x75-vw4g - Exploit, Vendor Advisory

03 Sep 2024, 12:59

Type	Values Removed	Values Added
Summary		(es) Halo es una herramienta de código abierto para crear sitios web. Se ha identificado una vulnerabilidad de seguridad en versiones anteriores a la 2.17.0 del proyecto Halo. Esta vulnerabilidad permite a un atacante ejecutar secuencias de comandos maliciosas en el navegador del usuario a través de código HTML y JavaScript específico, lo que puede provocar un ataque de Cross-site Scripting (XSS). Se recomienda a los usuarios que actualicen a la versión 2.17.0+. No se conocen workarounds para esta vulnerabilidad.

02 Sep 2024, 18:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-09-02 18:15

Updated : 2024-09-16 16:26

NVD link : CVE-2024-43792

Mitre link : CVE-2024-43792

CVE.ORG link : CVE-2024-43792

JSON object : View

Products Affected

halo

halo

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2024-43792", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.8}]}, "published": "2024-09-02T18:15:35.807", "references": [{"url": "https://github.com/halo-dev/halo/security/advisories/GHSA-x3rj-3x75-vw4g", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Halo is an open source website building tool. A security vulnerability has been identified in versions prior to 2.17.0 of the Halo project. This vulnerability allows an attacker to execute malicious scripts in the user's browser through specific HTML and JavaScript code, potentially leading to a Cross-Site Scripting (XSS) attack. Users are advised to upgrade to version 2.17.0+. There are no known workarounds for this vulnerability."}, {"lang": "es", "value": "Halo es una herramienta de c\u00f3digo abierto para crear sitios web. Se ha identificado una vulnerabilidad de seguridad en versiones anteriores a la 2.17.0 del proyecto Halo. Esta vulnerabilidad permite a un atacante ejecutar secuencias de comandos maliciosas en el navegador del usuario a trav\u00e9s de c\u00f3digo HTML y JavaScript espec\u00edfico, lo que puede provocar un ataque de Cross-site Scripting (XSS). Se recomienda a los usuarios que actualicen a la versi\u00f3n 2.17.0+. No se conocen workarounds para esta vulnerabilidad."}], "lastModified": "2024-09-16T16:26:18.063", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:halo:halo:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1F0A843B-5A28-4D3B-BBCD-CA5BE1EAD754", "versionEndExcluding": "2.17.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}