PT-2024-32407 · Follett · Follet School Solutions Destiny

Published 2024-10-07 · Updated 2024-10-10 · CVE-2024-47095

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Follet School Solutions Destiny versions prior to 22.0.1 AU1

Description The issue allows a remote attacker to run arbitrary client-side code via the expiredSupportMessage parameter of the "handleloginform.do" endpoint. This enables the attacker to execute malicious scripts on the client-side.

Recommendations For versions prior to 22.0.1 AU1, upgrade to the latest version to protect against this issue. As a temporary workaround, consider restricting access to the "handleloginform.do" endpoint to minimize the risk of exploitation. Avoid using the expiredSupportMessage parameter in the affected endpoint until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-47095

Affected Products

Follet School Solutions Destiny

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-47095 · Security Note
• https://securin.io/zerodays/cve-2024-47095-reflected-cross-site-scripting-in-follett-school-solutions-destiny-library-manager · Note
• https://twitter.com/securin_inc/status/1843343400549892328 · Twitter Post
• https://twitter.com/CVEnew/status/1843567338559283407 · Twitter Post
• https://t.me/cvenotify/97394 · Telegram Post
• https://t.me/cvedetector/7331 · Telegram Post