CVE-2023-38964

MEDIUMNuclei

Academy LMS 6.0 - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2023-38964 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

Creative Item Academy LMS 6.0 was discovered to contain a cross-site scripting (XSS) vulnerability.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 17, 2024 · Source: CVE List

Nuclei templates

1
ProjectDiscoveryMEDIUMAcademy LMS 6.0 - Cross-Site ScriptingCVSS 6.1

Creative Item Academy LMS 6.0 was discovered to contain a cross-site scripting (XSS) vulnerability through `query` parameter.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement of the affected website.

Remediation

Apply the latest security patches provided by the vendor to mitigate the XSS vulnerability in Creative Item Academy LMS 6.0.

WeaknessesCWE-79
Authorsritikchaddha
Template tagscve2023cveacademylmsxsscreativeitemvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:creativeitem:academy_lms:6.0:*:*:*:*:*:*:*
Shodan: http.html:"academy lms"
FOFA: body="Academy LMS"
FOFA: body="academy lms"
https://vida03.gitbook.io/redteam/web/cve-2023-38964 https://nvd.nist.gov/vuln/detail/CVE-2023-38964

Source: ProjectDiscovery

References

2