Lucene search

[email protected]NVD:CVE-2024-2593

HistoryMar 18, 2024 - 2:15 p.m.

CVE-2024-2593

2024-03-1814:15:12

CWE-79

[email protected]

web.nvd.nist.gov

vulnerability

amss++

version 4.31

user-controlled input

cross-site scripting

xss

remote attacker

authenticated user

session cookie credentials

7.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

0.0004 Low

EPSS

Percentile

9.1%

JSON

Vulnerability in AMSS++ version 4.31, which does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting (XSS) vulnerability through /amssplus/modules/book/main/bookdetail_group.php, in the ‘b_id’ parameter. This vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials.

References

www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss