CVE-2024-55239: XSS
A reflected Cross-Site Scripting vulnerability in the standard documentation upload functionality in Portabilis i-Educar 2.9 allows attacker to craft malicious urls with arbitrary javascript in the 'titulodocumento' parameter.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-55239?
CVE-2024-55239 is classified as a critical severity vulnerability due to its ability to allow reflected Cross-Site Scripting.
How do I fix CVE-2024-55239?
To fix CVE-2024-55239, you should validate and sanitize the 'titulo_documento' parameter to prevent the injection of malicious scripts.
What impact does CVE-2024-55239 have on users?
CVE-2024-55239 can allow attackers to execute arbitrary JavaScript in the context of a user's browser, potentially compromising user data and security.
Which versions of i-Educar are affected by CVE-2024-55239?
CVE-2024-55239 affects Portabilis i-Educar version 2.9 and potentially other versions if they use the same documentation upload functionality.
Is user interaction required to exploit CVE-2024-55239?
Yes, exploiting CVE-2024-55239 typically requires user interaction, as users must click on a crafted malicious URL for the attack to succeed.