Lucene search

[email protected]NVD:CVE-2024-8471

HistorySep 05, 2024 - 1:15 p.m.

CVE-2024-8471

2024-09-0513:15:14

CWE-79

[email protected]

web.nvd.nist.gov

cross-site scripting

user-controlled input

encryption

session details

authenticated user

jobid parameter

username parameter

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

17.7%

JSON

Cross-Site Scripting (XSS) vulnerability, whereby user-controlled input is not sufficiently encrypted. Exploitation of this vulnerability could allow an attacker to retrieve the session details of an authenticated user through JOBID and USERNAME parameters in /jobportal/process.php.

Affected configurations

Nvd

Node

phpgurukuljob_portalMatch1.0

VendorProductVersionCPE
phpgurukuljob_portal1.0cpe:2.3:a:phpgurukul:job_portal:1.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
phpgurukul	job_portal	1.0	cpe:2.3:a:phpgurukul:job_portal:1.0:::::::*

References

www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-job-portal

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

17.7%

JSON

Related for NVD:CVE-2024-8471

cve1 vulnrichment1 cvelist1