CVE-2024-33990: Cross-Site Scripting (XSS) vulnerability in Janobe School Event Management System

Published Aug 6, 2024

Updated

Cross-Site Scripting (XSS) vulnerability in School Event Management System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted javascript payload to an authenticated user and partially take over their browser session via the 'id' and 'view' parameters in '/user/index.php'.

Affected Software

1 affected component

Janobe School Event Management System=1.0

Remediation

Information

There is no reported solution at this time.

Event History

Aug 6, 2024

CVE Published

via MITRE·01:06 PM

Data Sourced

via MITRE·01:06 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-33990?

CVE-2024-33990 is classified as a Cross-Site Scripting (XSS) vulnerability which can lead to serious security risks if exploited.

How do I fix CVE-2024-33990?

To mitigate CVE-2024-33990, ensure that you update your School Event Management System to the latest version that addresses this XSS vulnerability.

Who is affected by CVE-2024-33990?

CVE-2024-33990 specifically affects users of Janobe's School Event Management System version 1.0.

What types of attacks can be performed using CVE-2024-33990?

An attacker can exploit CVE-2024-33990 by sending a malicious JavaScript payload that could partially take over the user's browser session.

Is authentication required to exploit CVE-2024-33990?

Yes, CVE-2024-33990 can only be exploited by an attacker who has access to an authenticated user's session.