Lucene search

TMLCVE-2024-28096

HistoryMar 07, 2024 - 4:15 a.m.

CVE-2024-28096

2024-03-0704:15:07

CWE-79

TML

web.nvd.nist.gov

cve

2024

28096

schoolbox

application

vulnerability

xss

security

authenticated attacker

nvd

CVSS3

7.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

AI Score

6.7

Confidence

High

EPSS

Percentile

9.0%

JSON

Class functionality in Schoolbox application
before version 23.1.3 is vulnerable to stored cross-site scripting
allowing authenticated attacker to perform security actions in the
context of the affected users.

CNA Affected

[
  {
    "defaultStatus": "affected",
    "product": "Schoolbox",
    "vendor": "Schoolbox Pty Ltd",
    "versions": [
      {
        "lessThan": "23.1.3",
        "status": "affected",
        "version": "0",
        "versionType": "Minor"
      }
    ]
  }
]

References

schoolbox.education/

www.themissinglink.com.au/security-advisories/cve-2024-28096

CVSS3

7.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

AI Score

6.7

Confidence

High

EPSS

Percentile

9.0%

JSON

Related for CVE-2024-28096