Lucene search

[email protected]NVD:CVE-2024-2597

HistoryMar 18, 2024 - 2:15 p.m.

CVE-2024-2597

2024-03-1814:15:13

CWE-79

[email protected]

web.nvd.nist.gov

amss++

xss

cross-site scripting

remote attacker

url

authenticated user

session cookie credentials

7.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

0.0004 Low

EPSS

Percentile

9.1%

JSON

Vulnerability in AMSS++ version 4.31, which does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting (XSS) vulnerability through /amssplus/modules/book/main/bookdetail_school_person.php, in the ‘b_id’ parameter. This vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials.

References

www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss