Lucene search

TMLCVELIST:CVE-2024-28095

HistoryMar 07, 2024 - 3:17 a.m.

CVE-2024-28095 Stored Cross-site Scripting in News functionality in Schoolbox

2024-03-0703:17:02

CWE-79

TML

www.cve.org

cve-2024-28095

stored cross-site scripting

schoolbox

news functionality

authentication bypass

7.3 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

0.0004 Low

EPSS

Percentile

9.1%

JSON

News functionality in Schoolbox application before
version 23.1.3 is vulnerable to stored cross-site scripting allowing
authenticated attacker to perform security actions in the context of the
affected users.

CNA Affected

[
  {
    "defaultStatus": "affected",
    "product": "Schoolbox",
    "vendor": "Schoolbox Pty Ltd",
    "versions": [
      {
        "lessThan": "23.1.3",
        "status": "affected",
        "version": "0",
        "versionType": "Minor"
      }
    ]
  }
]

References

schoolbox.education/

www.themissinglink.com.au/security-advisories/cve-2024-28095

7.3 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

0.0004 Low

EPSS

Percentile

9.1%

JSON

Related for CVELIST:CVE-2024-28095