Lucene search

[email protected]NVD:CVE-2023-38881

HistoryNov 20, 2023 - 7:15 p.m.

CVE-2023-38881

2023-11-2019:15:08

CWE-79

[email protected]

web.nvd.nist.gov

reflected cross-site scripting

remote attackers

arbitrary javascript

web browser

parameters

calendarmodal.php

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

31.0%

JSON

A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED’s openSIS Classic allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into any of the ‘calendar_id’, ‘school_date’, ‘month’ or ‘year’ parameters in ‘CalendarModal.php’.

Affected configurations

Nvd

Node

os4edopensisMatch9.0community

VendorProductVersionCPE
os4edopensis9.0cpe:2.3:a:os4ed:opensis:9.0:*:*:*:community:*:*:*

Vendor	Product	Version	CPE
os4ed	opensis	9.0	cpe:2.3:a:os4ed:opensis:9.0::::community:::

References

github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38881

github.com/OS4ED/openSIS-Classic

www.os4ed.com/

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

31.0%

JSON

Related for NVD:CVE-2023-38881

prion1 osv1 cvelist1 cve1