CVE-2024-51379

Stored Cross-Site Scripting (XSS) vulnerability discovered in JATOS v3.9.3

High · published November 5, 2024

CVSS v3.1
8.4
EPSS
1%
Percentile
50.2
In the wild
Unconfirmed
What it is

Stored Cross-Site Scripting (XSS) vulnerability discovered in JATOS v3.9.3. The vulnerability exists in the description component of the study section, where an attacker can inject JavaScript into the description field. This allows for the execution of malicious scripts when an admin views the description, potentially leading to account takeover and unauthorized actions.

The record
Technical detail
CVSS v3.1
8.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00644 · 50.2th percentile
Published
2024-11-05T00:00Z
EPSS history
Timeline
  • 05 NOV 00:00Z
    Stored Cross-Site Scripting (XSS) vulnerability discovered in JATOS v3.9.3
    cvelistv5