TMLVULNRICHMENT:CVE-2024-28097CVE-2024-28097 Stored Cross-site Scripting in Calendar functionality in Schoolbox
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
AI Score
Confidence
High
SSVC
Exploitation
none
Automatable
no
Technical Impact
total
Calendar functionality in Schoolbox application
before version 23.1.3 is vulnerable to stored cross-site scripting
allowing authenticated attacker to perform security actions in the
context of the affected users.
ADP Affected
[
{
"cpes": [
"cpe:2.3:a:schoolbox:schoolbox:*:*:*:*:*:*:*:*"
],
"vendor": "schoolbox",
"product": "schoolbox",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "23.1.3",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
}
]Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
AI Score
Confidence
High
SSVC
Exploitation
none
Automatable
no
Technical Impact
total