Cross-Site Scripting Vulnerability in SOPlanning by SYNAPSE
CVE-2024-9572

6.3MEDIUM

Key Information:

Vendor

Soplanning

Status
Soplanning
Vendor
CVE Published:
7 October 2024

What is CVE-2024-9572?

A Cross-Site Scripting (XSS) vulnerability exists in SOPlanning, versions earlier than 1.45, stemming from inadequate validation of user input in the groupe_id parameter via the file /soplanning/www/process/groupe_save.php. This flaw could empower an attacker to craft a malicious query that, when sent to an authenticated user, may lead to the theft of session identifiers, compromising user security.

Affected Version(s)

SOPlanning 0 < 1.45

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multip...

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

.