FeedlyFeedly
CVEsCVEs
Threat IntelligenceThreat Intelligence
Threat IntelligenceThreat Intelligence
Log in
ChangelogChangelog
ChangelogChangelog
Log in
Log in
Start Free Trial
Start Free Trial
FeedlyFeedly
CVEsCVEs
Threat IntelligenceThreat Intelligence
Threat IntelligenceThreat Intelligence
Log in
ChangelogChangelog
ChangelogChangelog
Log in
Log in
Start Free Trial
Start Free Trial

Exploit
CVE-2024-9806

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)

Published: Oct 10, 2024 / Updated: 40d ago

010
CVSS 5.3EPSS 0.05%Medium
CVE info copied to clipboard

Summary

A cross-site scripting (XSS) vulnerability has been discovered in Craig Rodway Classroombookings versions up to 2.8.6. The vulnerability affects the Room Page component, specifically in the file /rooms/fields. The issue arises from improper neutralization of input during web page generation, allowing manipulation of the "Name" argument to potentially execute malicious scripts.

Impact

This vulnerability could allow an attacker to execute malicious scripts in a victim's browser context, potentially leading to theft of sensitive information, session hijacking, or defacement of the web application. The attack can be initiated remotely, but requires user interaction and high privileges. The confidentiality and integrity impacts are rated as low, with no direct impact on availability. The CVSS v3.1 base score is 4.8 (Medium severity), while the CVSS v4.0 base score is 5.3 (Medium severity).

Exploitation

One proof-of-concept exploit is available on github.com. There is no evidence of proof of exploitation at the moment.

Patch

A patch is available. Upgrading to Classroombookings version 2.8.7 addresses this vulnerability.

Mitigation

1. Upgrade Classroombookings to version 2.8.7 as soon as possible. 2. If immediate upgrading is not feasible, implement input validation and output encoding for the "Name" parameter in the /rooms/fields component. 3. Consider implementing Content Security Policy (CSP) headers to mitigate the risk of XSS attacks. 4. Educate users with high privileges about the risks of XSS and how to identify potential attacks. 5. Monitor for suspicious activities or unexpected script executions in the Room Page component.

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Timeline

First Article

Feedly found the first article mentioning CVE-2024-9806. See article

Oct 10, 2024 at 6:37 PM / CVE
CVSS Estimate

Feedly estimated the CVSS score as MEDIUM

Oct 10, 2024 at 6:37 PM
CVE Assignment

NVD published the first details for CVE-2024-9806

Oct 10, 2024 at 7:15 PM
CVSS

A CVSS base score of 3.5 has been assigned.

Oct 10, 2024 at 7:20 PM / nvd
EPSS

EPSS Score was set to: 0.05% (Percentile: 16.4%)

Oct 11, 2024 at 10:19 AM
CVSS

A CVSS base score of 4.8 has been assigned.

Oct 17, 2024 at 2:45 PM / nvd
Proof of Concept (PoC) Released

A proof of concept exploit has been released

Oct 17, 2024 at 5:12 PM
Static CVE Timeline Graph

Affected Systems

Classroombookings/classroombookings
+null more

Exploits

https://github.com/JunMing27/CVE/blob/main/CVE%20-%20classroombookings%20Cross%20Site%20Scripting%20(XSS)%20at%20custom%20field.md
+null more

Attack Patterns

CAPEC-209: XSS Using MIME Type Mismatch
+null more

News

CVE-2024-9806 Exploit
inTheWild.io Exploits / 33d
CVE Id : CVE-2024-9806 Published Date: 2024-10-17T14:44:00+00:00 A vulnerability has been found in Craig Rodway Classroombookings up to 2.8.6 and classified as problematic. This vulnerability affects unknown code of the file /rooms/fields of the component Room Page. The manipulation of the argument Name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.8.7 is able to address this issue. It is recommended to upgrade the affected component. The project maintainer was contacted early about the disclosure.
#cybersecurity / 39d
CVE Alert: CVE-2024-9806 - https://www. redpacketsecurity.com/cve_aler t_cve-2024-9806/ # OSINT # ThreatIntel # CyberSecurity # cve_2024_9806
CVE-2024-9806
INCIBE-CERT - Vulnerabilities RSS / 40d
It is recommended to upgrade the affected component. This vulnerability affects unknown code of the file /rooms/fields of the component Room Page.
NA - CVE-2024-9806 - A vulnerability has been found in Craig Rodway...
Security-Database Alerts Monitor : Last 100 Alerts / 40d
A vulnerability has been found in Craig Rodway Classroombookings up to 2.8.6 and classified as problematic. This vulnerability affects unknown code of the file /rooms/fields of the component Room...
CVE-2024-9806
Updated CVEs from Tenable / 40d
It is recommended to upgrade the affected component. This vulnerability affects unknown code of the file /rooms/fields of the component Room Page.
See 6 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:High
User Interaction:Required
Scope:Changed
Confidentiality:Low
Integrity:Low
Availability Impact:None

Categories

CVSS 4.8(21798)CWE-79(31345)Classroombookings(4)

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI

Feedly Threat Intelligence30-day free trial