Lucene search

TMLCVELIST:CVE-2024-28097

HistoryMar 07, 2024 - 3:21 a.m.

CVE-2024-28097 Stored Cross-site Scripting in Calendar functionality in Schoolbox

2024-03-0703:21:21

CWE-79

TML

www.cve.org

cve-2024-28097

stored cross-site scripting

schoolbox

calendar functionality

security actions

CVSS3

7.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

EPSS

Percentile

9.0%

JSON

Calendar functionality in Schoolbox application
before version 23.1.3 is vulnerable to stored cross-site scripting
allowing authenticated attacker to perform security actions in the
context of the affected users.

CNA Affected

[
  {
    "defaultStatus": "affected",
    "product": "Schoolbox",
    "vendor": "Schoolbox Pty Ltd",
    "versions": [
      {
        "lessThan": "23.1.3",
        "status": "affected",
        "version": "0",
        "versionType": "Minor"
      }
    ]
  }
]

References

schoolbox.education/

www.themissinglink.com.au/security-advisories/cve-2024-28097

CVSS3

7.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

EPSS

Percentile

9.0%

JSON

Related for CVELIST:CVE-2024-28097