CVE-2026-124498: Convene Azeus Convene Board Management Portal dummy_launcher.jsp cross site scripting
A vulnerability was determined in Convene Azeus Convene Board Management Portal 7.0.2.73 p72. The impacted element is an unknown function of the file /jsp/ge/dummylauncher.jsp. Executing a manipulation of the argument REDIRECTURL can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attack can be launched remotely, but the CVSS vector indicates low privileges and user interaction are required. The disclosed exploit targets the REDIRECT_URL argument handled by /jsp/ge/dummy_launcher.jsp.
Which deployment is known to be affected?
The affected product and version identified in the available data is Azeus Convene Board Management Portal 7.0.2.7_3 p72. No information is provided about other versions or whether the vulnerable behavior is enabled by default.
Is public exploit information available?
Yes. A proof-of-concept is flagged, and the vulnerability information states that an exploit has been publicly disclosed and may be used.
Is a vendor fix or response available?
No vendor response or remediation information is provided. The available data states that the vendor was contacted early but did not respond.