What is the severity of CVE-2024-33980?

CVE-2024-33980 is classified as a medium severity Cross-Site Scripting (XSS) vulnerability.

How do I fix CVE-2024-33980?

To fix CVE-2024-33980, ensure you apply the latest security patches provided by Janobe for version 1.0 of the affected products.

Which software versions are affected by CVE-2024-33980?

CVE-2024-33980 affects version 1.0 of Janobe's PayPal, Credit Card, and Debit Card Payment products.

What type of attack can be executed through CVE-2024-33980?

An attacker can exploit CVE-2024-33980 through Cross-Site Scripting (XSS) to obtain session cookie details from victims.

Is user intervention required to exploit CVE-2024-33980?

Yes, exploitation of CVE-2024-33980 requires the victim to click on a specially crafted URL.

Vulnerability/
CVE-2024-33980

high

7.1

CWE

6/8/2024

15/8/2024

CVE-2024-33980: Cross-site Scripting in Janobe products

First published: Tue Aug 06 2024(Updated: )

Cross-Site Scripting (XSS) vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'start' parameter in '/admin/mod_reports/printreport.php'.

Credit: cve-coordination@incibe.es

Affected Software	Affected Version	How to fix
Janobe Credit Card	=1.0
Janobe Debit Card Payment	=1.0
Paypal	=1.0

Remedy

There is no reported solution at this time.

Never miss a vulnerability like this again

Reference Links

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products

Frequently Asked Questions

What is the severity of CVE-2024-33980?
CVE-2024-33980 is classified as a medium severity Cross-Site Scripting (XSS) vulnerability.
How do I fix CVE-2024-33980?
To fix CVE-2024-33980, ensure you apply the latest security patches provided by Janobe for version 1.0 of the affected products.
Which software versions are affected by CVE-2024-33980?
CVE-2024-33980 affects version 1.0 of Janobe's PayPal, Credit Card, and Debit Card Payment products.
What type of attack can be executed through CVE-2024-33980?
An attacker can exploit CVE-2024-33980 through Cross-Site Scripting (XSS) to obtain session cookie details from victims.
Is user intervention required to exploit CVE-2024-33980?
Yes, exploitation of CVE-2024-33980 requires the victim to click on a specially crafted URL.

agent/references
agent/author
agent/weakness
agent/type
agent/description
agent/remedy
agent/first-publish-date
agent/title
collector/mitre-cve
source/MITRE
agent/severity
agent/last-modified-date
agent/softwarecombine
agent/event
agent/source
agent/tags
collector/nvd-api
source/NVD
agent/software-canonical-lookup
agent/software-canonical-lookup-request
vendor/janobe
canonical/janobe credit card
version/janobe credit card/1.0
canonical/janobe debit card payment
version/janobe debit card payment/1.0
canonical/paypal
version/paypal/1.0

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.