Vulnerability · Published Oct 31, 2022 · Assigned by TML
CVE-2022-39020Cross-site scripting in Schoolbox version 21.0.2, by Schoolbox Pty Ltd
High 7.6
In plain English
A high-severity cross-site scripting in Schoolbox from Schoolbox Pty Ltd. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).
Severity (CVSS 3.1)7.6High
Exploit odds (30 days)0.5%top 59.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Multiple instances of XSS (stored and reflected) was found in the application. For example, features such as student assessment submission, file upload, news, ePortfolio and calendar event creation were found to be vulnerable to cross-site scripting.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Schoolbox Pty Ltd | Schoolbox | 21.0.2 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L