CVE-2024-9807 Craig Rodway Classroombookings Session Page sessions cross site scripting
Remote attackers can inject malicious scripts via the Name argument in the Session Page, potentially executing code in victim browsers.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-9807?
CVE-2024-9807 is a medium-severity cross-site scripting vulnerability in Craig Rodway Classroombookings, published on 10 Oct 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A vulnerability was found in Craig Rodway Classroombookings 2.8.7 and classified as problematic. This issue affects some unknown processing of the file /sessions of the component Session Page. The manipulation of the argument Name leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 2.8.8 is able to address this issue. It is recommended to upgrade the affected component. The project maintainer was contacted early about the disclosure. He responded very quickly, friendly, and professional.
Weakness: CWE-79
Which versions are affected by CVE-2024-9807?
It affects 1 product.
Products include Classroombookings Classroombookings.
How do I fix CVE-2024-9807?
No fix has been published for CVE-2024-9807 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-9807 being exploited?
There is no known exploitation of CVE-2024-9807 in the wild and no public exploit code.
Other vulnerabilities in Craig Rodway Classroombookings
Sources
Also known as GHSA-j457-97cq-4x7p.