Log in Start free

Vulnerability · Published Apr 1, 2024 · Assigned by VulDB

CVE-2024-3138francoisjacquet RosarioSIS Add Portal Note cross site scripting

Low 3.5

In plain English

A low-severity cross-site scripting in RosarioSIS from francoisjacquet. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)3.5Low
Exploit odds (30 days)0.5%top 59.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

** DISPUTED ** A vulnerability was found in francoisjacquet RosarioSIS 11.5.1. It has been rated as problematic. This issue affects some unknown processing of the component Add Portal Note. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The associated identifier of this vulnerability is VDB-258911. NOTE: The vendor explains that the PDF is opened by the browser app in a sandbox, so no data from the website should be accessible.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistfrancoisjacquet/rosariosisno fix listedGHSA-r32g-w9cv-9fgc

Affected products (as reported)

VendorProductVersions
francoisjacquet RosarioSIS 11.5.1

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

References