Lucene search

K
cvelistINCIBECVELIST:CVE-2024-33987
HistoryAug 06, 2024 - 1:03 p.m.

CVE-2024-33987 Cross-Site Scripting (XSS) vulnerability in Janobe products

2024-08-0613:03:47
CWE-79
INCIBE
www.cve.org
5
cve-2024
cross-site scripting
janobe products
school attendance monitoring system
school event management system
version 1.0
specially crafted url
session cookie
'attendance'
'attenddate'
'yearlevel'
'eventdate'
'events'
'users'
'/report/index.php'

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

EPSS

0.001

Percentile

17.7%

Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the ‘Attendance’, ‘attenddate’, ‘YearLevel’, ‘eventdate’, ‘events’, ‘Users’ and ‘YearLevel’ parameters in ‘/report/index.php’.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "School Attendance Monitoring System",
    "vendor": "Janobe",
    "versions": [
      {
        "status": "affected",
        "version": "1.0"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "School Event Management System",
    "vendor": "Janobe",
    "versions": [
      {
        "status": "affected",
        "version": "1.0"
      }
    ]
  }
]

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

EPSS

0.001

Percentile

17.7%

Related for CVELIST:CVE-2024-33987