CVE-2024-43792 is a Cross-Site Scripting (XSS) vulnerability affecting Halo versions prior to 2.17.0, an open-source website building tool. This flaw allows an unauthenticated attacker to execute malicious scripts in a user's browser with low attack complexity, potentially leading to limited confidentiality and integrity impacts. Rated Medium severity (CVSS 6.1), there are currently no known public exploits, Metasploit modules, or significant community discussion or media coverage surrounding this vulnerability. Users are advised to upgrade to version 2.17.0 or later as no workarounds exist.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.17.0CPE matchmatch criteria | cpe:2.3:a:halo:halo:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.