Back to Database
Status published
Medium
CVE-2024-43793
Halo's editor has a stored XSS vulnerability
Vulnerability Description
Halo is an open source website building tool. A security vulnerability has been identified in versions prior to 2.19.0 of the Halo project. This vulnerability allows an attacker to execute malicious scripts in the user's browser through specific HTML and JavaScript code, potentially leading to a Cross-Site Scripting (XSS) attack. This vulnerability is fixed in 2.19.0.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-43793
Credits & Attribution
No credits recorded in the NVD database.
More from halo-dev
View All →CVE-2024-56156
Halo Vulnerable to Stored XSS and RCE via File Upload Bypass
Medium
5.5
CVE-2024-43792
Halo's editor has a stored Cross-Site Scripting vulnerability
Medium
6.3
CVE-2022-22125
Halo CMS - Stored Cross-Site Scripting (XSS) in Article's Tag
Medium
4.8
CVE-2022-22124
Halo CMS - Stored Cross-Site Scripting (XSS) in Profile Image
Medium
5.4
CVE-2022-22123
Halo CMS - Stored Cross-Site Scripting (XSS) in Article's Title
Medium
5.4
Affected Vendor
halo-dev
View all reports →Affected Software
halo
Vulnerable Versions:
< 2.19.0
Timeline
Official Publish:
September 11th, 2024
Last Modified:
September 11th, 2024
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L