CVE-2022-39020

Cross-site scripting in Schoolbox version 21.0.2, by Schoolbox Pty Ltd

CVSS 7.6 HIGHEPSS 0.4%CWE-79

Vexday Risk Score

21Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 7.6EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

31 out 2022Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

Multiple instances of XSS (stored and reflected) was found in the application. For example, features such as student assessment submission, file upload, news, ePortfolio and calendar event creation were found to be vulnerable to cross-site scripting.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L

Produtos afetados

Schoolbox Pty Ltd · Schoolbox

Referências

https://www.themissinglink.com.au/security-advisories/cve-2022-39020