CVE-2024-33988

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-33988
Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'Attendance', 'attenddate' and 'YearLevel' parameters in '/report/attendance_print.php'.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:janobe:school_attendence_monitoring_system:1.0:*:*:*:*:*:*:*
cpe:2.3:a:janobe:school_event_management_system:1.0:*:*:*:*:*:*:*
History

15 Aug 2024, 16:56

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 7.1 		v2 : unknown
v3 : 6.1
CPE cpe:2.3:a:janobe:school_attendence_monitoring_system:1.0:*:*:*:*:*:*:*
cpe:2.3:a:janobe:school_event_management_system:1.0:*:*:*:*:*:*:*
First Time Janobe
Janobe school Attendence Monitoring System
Janobe school Event Management System
Summary
  • (es) Vulnerabilidad de Cross-Site Scripting (XSS) en School Attendance Monitoring System and School Event Management System que afecta la versión 1.0. Un atacante podría crear una URL especialmente manipulada y enviarla a una víctima para obtener detalles de su cookie de sesión a través de los parámetros 'Asistencia', 'fecha de asistencia' y 'Nivel de año' en '/report/attendance_print.php'.
References () https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products - () https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products - Third Party Advisory

06 Aug 2024, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-08-06 13:15

Updated : 2024-08-15 16:56

NVD link : CVE-2024-33988

Mitre link : CVE-2024-33988

CVE.ORG link : CVE-2024-33988

JSON object : View

Products Affected

janobe

  • school_event_management_system
  • school_attendence_monitoring_system
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')