Lucene search

[email protected]CVE-2024-4822

HistoryMay 14, 2024 - 3:45 p.m.

CVE-2024-4822

2024-05-1415:45:13

CWE-79

[email protected]

web.nvd.nist.gov

vulnerability

school erp

xss

username

password

browser session

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Vulnerability in School ERP Pro+Responsive 1.0 that allows XSS via the username and password parameters in ‘/index.php’. This vulnerability allows an attacker to partially take control of the victim’s browser session.

Affected configurations

Vulners

Node

arox_solutionschool_erp_pro\+responsiveRange≤1.0

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "School ERP Pro+Responsive",
    "vendor": "AROX SOLUTION",
    "versions": [
      {
        "status": "affected",
        "version": "1.0"
      }
    ]
  }
]

References

www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-school-erp-proresponsive-arox-solution

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Related for CVE-2024-4822

cvelist1 nvd1 vulnrichment1