github.com
https://github.com/francoisjacquet/rosariosis CVE-2024-3138
LOW
francoisjacquet RosarioSIS Add Portal Note cross site scripting
Record summary
CVE-2024-3138 has a selected CVSS score of 3.5 (low).
Description
** DISPUTED ** A vulnerability was found in francoisjacquet RosarioSIS 11.5.1. It has been rated as problematic. This issue affects some unknown processing of the component Add Portal Note. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The associated identifier of this vulnerability is VDB-258911. NOTE: The vendor explains that the PDF is opened by the browser app in a sandbox, so no data from the website should be accessible.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 23, 2024 · Source: CVE List
Affected products and versions
3| Product | Source | Version range | Status |
|---|---|---|---|
RosarioSISBrowse francoisjacquet / RosarioSIS | CVE List | 11.5.1 | affected |
rosariosisBrowse rosariosis / rosariosisDefault status: unknown | CVE List | 11.5.1 | affected |
francoisjacquet/rosariosisBrowse Packagist / francoisjacquet/rosariosis | GitHub Advisory | Through 11.5.1 | affected |
References
6nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2024-3138 powerful-bulb-c36.notion.siteexploit
https://powerful-bulb-c36.notion.site/Stored-xss-via-malicious-PDF-upload-98fb1ea6b9bf4ddfaf04d61b2c05410a VDB-258911 | CTI Indicators (IOB, IOC, TTP)signaturepermissions required
https://vuldb.com/?ctiid.258911 VDB-258911 | francoisjacquet RosarioSIS Add Portal Note cross site scriptingvdb entry
https://vuldb.com/?id.258911 Submit #307450 | RosarioSIS RosarioSIS Student Information System v11.5.1 stored XSS at add portal noteThird-party advisory
https://vuldb.com/?submit.307450