Lucene search

TMLCVELIST:CVE-2022-39020

HistoryOct 31, 2022 - 8:06 p.m.

CVE-2022-39020 Cross-site scripting in Schoolbox version 21.0.2, by Schoolbox Pty Ltd

2022-10-3120:06:12

CWE-79

TML

www.cve.org

cve-2022-39020

cross-site scripting

schoolbox pty ltd

stored xss

reflected xss

student assessment submission

file upload

news

eportfolio

calendar event creation

7.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L

7.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

31.5%

JSON

Multiple instances of XSS (stored and reflected) was found in the application. For example, features such as student assessment submission, file upload, news, ePortfolio and calendar event creation were found to be vulnerable to cross-site scripting.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Schoolbox",
    "vendor": "Schoolbox Pty Ltd",
    "versions": [
      {
        "status": "affected",
        "version": "21.0.2"
      }
    ]
  }
]

References

www.themissinglink.com.au/security-advisories/cve-2022-39020