CVE-2024-33988: Cross-Site Scripting (XSS) vulnerability in Janobe products

Published Aug 6, 2024

Updated

Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'Attendance', 'attenddate' and 'YearLevel' parameters in '/report/attendanceprint.php'.

Affected Software

2 affected components

Janobe School Attendence Monitoring System=1.0

Janobe School Event Management System=1.0

Remediation

Information

There is no reported solution at this time.

Event History

Aug 6, 2024

CVE Published

via MITRE·01:04 PM

Data Sourced

via MITRE·01:04 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-33988?

CVE-2024-33988 is considered a medium severity Cross-Site Scripting (XSS) vulnerability.

How do I fix CVE-2024-33988?

To fix CVE-2024-33988, update the affected software to the latest version provided by the vendor.

Which versions are affected by CVE-2024-33988?

CVE-2024-33988 affects version 1.0 of the Janobe School Attendance Monitoring System and School Event Management System.

Can CVE-2024-33988 allow attackers to steal session cookies?

Yes, CVE-2024-33988 allows attackers to create malicious links that can be used to steal session cookies from victims.

What type of vulnerability is CVE-2024-33988?

CVE-2024-33988 is a Cross-Site Scripting (XSS) vulnerability.