PT-2020-7769 · Unknown · Open-School Community Edition
Published
2020-02-08
·
Updated
2020-02-10
·
CVE-2014-9126
CVSS v2.0
4.3
Medium
| Vector | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions:
Open-School Community Edition version 2.2
Description:
The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved via the YII CSRF TOKEN HTTP cookie or the
StudentDocument, StudentCategories, StudentPreviousDatas parameters to the "index.php" endpoint.Recommendations:
For Open-School Community Edition version 2.2, consider restricting access to the
YII CSRF TOKEN HTTP cookie and the StudentDocument, StudentCategories, StudentPreviousDatas parameters in the "index.php" endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Open-School Community Edition