Cross-Site Scripting Vulnerability in RosarioSIS
Summary
CVE-2024-3138: RosarioSIS cross site scripting vulnerability. Affects francoisjacquet/rosariosis versions < 11.5.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
RosarioSIS is an open-source school management system developed by francoisjacquet. It provides various features for managing student information, attendance, grades, and more. The vulnerability affects version 11.5.1 of the RosarioSIS package.
Vulnerability Detail
The vulnerability in RosarioSIS is a cross-site scripting (XSS) issue. It is triggered during the processing of the 'Add Portal Note' component. An attacker can exploit this vulnerability remotely, potentially leading to the execution of malicious scripts on the user's browser. The real existence of this vulnerability is currently disputed, but it has been disclosed publicly and may be utilized by attackers. The associated identifier for this vulnerability is VDB-258911. It is important to note that the vendor claims the PDF is opened in a sandboxed environment by the browser, which should prevent access to website data.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
In conclusion, the RosarioSIS package version 11.5.1 is affected by a cross-site scripting vulnerability. It is recommended to update the package to a patched version as soon as it becomes available. Regularly checking for updates and applying them promptly is crucial for maintaining the security of your RosarioSIS installation. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for francoisjacquet/rosariosis →
FAQ
The vulnerability allows an attacker to execute malicious scripts on the user's browser, potentially leading to unauthorized access, data theft, or other malicious activities.
The vulnerability has been disclosed publicly, but its real existence is currently disputed. However, it is always recommended to take necessary precautions and apply security updates to mitigate potential risks.
Yes, the vulnerability can be exploited remotely by an attacker.
The severity of this vulnerability is rated as LOW according to the Common Vulnerability Scoring System (CVSS) version 3.1. The CVSS score for this vulnerability is 3.5.
For more information about this vulnerability, you can refer to the associated identifier VDB-258911 or the source link provided in the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for francoisjacquet/rosariosis.
