CVE Radar Logo
CVERadar
CVE Radar Logo
CVERadar

CVE-2024-4823

Medium Severity
SVRS
30/100

CVSSv3
NA/10

EPSS
0.00175/1

CVE-2024-4823 exposes a cross-site scripting (XSS) vulnerability in School ERP Pro+Responsive 1.0. This flaw allows an attacker to inject malicious JavaScript code via several parameters within the '/schoolerp/office_admin/' index, including es_bankacc, es_bank_name, and others. By crafting a specific payload, attackers can target authenticated users, potentially hijacking their browser sessions. The SOCRadar Vulnerability Risk Score (SVRS) for CVE-2024-4823 is 30, suggesting a lower, but still present, level of risk. While not immediately critical based on the SVRS threshold, this vulnerability, categorized as CWE-79, is still a concern, as it can lead to unauthorized actions within the application if exploited. Immediate patching is recommended, especially given it has been tagged as "In The Wild", indicating active exploitation attempts. This vulnerability can compromise user data and system integrity, making it important to mitigate security concerns promptly.

In The Wild
2024-05-14

2024-05-14
Eye Icon
SOCRadar
AI Insight

Description

CVE-2024-4823 is a vulnerability with a CVSS score of 0, indicating a low severity level. However, SOCRadar's SVRS assigns it a score of 34, highlighting the potential for exploitation. This discrepancy stems from SOCRadar's integration of additional intelligence sources, including social media, news, and dark web data.

Key Insights

  • Active Exploitation: The vulnerability is actively exploited in the wild, posing an immediate threat to organizations.
  • Low CVSS Score: The CVSS score of 0 may underestimate the severity of the vulnerability, as it does not consider the broader context and intelligence gathered by SOCRadar.
  • SVRS Score: The SVRS score of 34 indicates a moderate level of risk, warranting attention and prompt mitigation.
  • Threat Actors: Specific threat actors or APT groups exploiting this vulnerability have not been identified at this time.

Mitigation Strategies

  • Apply Software Updates: Install the latest software updates from the vendor to patch the vulnerability.
  • Enable Intrusion Detection Systems (IDS): Configure IDS to monitor for suspicious activity and alert on potential exploitation attempts.
  • Implement Network Segmentation: Divide the network into smaller segments to limit the spread of an attack if exploitation occurs.
  • Educate Users: Train users on cybersecurity best practices, such as avoiding suspicious links and attachments.

Additional Information

If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.

Indicators of Compromise

No IOCs found for this CVE

Exploits

No exploits found for this CVE

Enhance Your CVE Management with SOCRadar Vulnerability Intelligence
Get comprehensive CVE details, real-time notifications, and proactive threat management all in one platform.
CVE Details
Access comprehensive CVE information instantly
Real-time Tracking
Subscribe to CVEs and get instant updates
Exploit Analysis
Monitor related APT groups and threats
IOC Tracking
Analyze and track CVE-related IOCs

News

CVE-2024-4823 | Arox Solution School ERP Pro+Responsive 1.0 /schoolerp/office_admin/ cross site scripting
vuldb.com2025-03-30
CVE-2024-4823 | Arox Solution School ERP Pro+Responsive 1.0 /schoolerp/office_admin/ cross site scripting | A vulnerability classified as problematic has been found in Arox Solution School ERP Pro+Responsive 1.0. This affects an unknown part of the file /schoolerp/office_admin/. The manipulation of the argument es_bankacc/es_bank_name/es_bank_pin/es_checkno/es_teller_number/dc1/dc2 leads to cross site scripting. This vulnerability is uniquely identified as CVE-2024-4823<
vuldb.com
rss
forum
news
Vulnerability Summary for the Week of May 13, 2024
CISA2024-05-20
2dc682d0fcad713a96cc38477d6 which was released along with the extension version `0.35`. As a workaround, Chrome users can use the Extensions Settings to disable the extension access to only the origins that you want. Firefox doesn't have an alternative to upgrading to a fixed version. 2024-05-14 7.6 CVE-2024-34714
cisa.gov
rss
forum
news

Social Media

CVE-2024-4823 Vulnerability in School ERP Pro+Responsive 1.0 that allows XSS via the index '/schoolerp/office_admin/' in the parameters es_bankacc, es_bank_name, es_bank_pin, es_chec… https://t.co/u8m9OERI1f
0
0
0
⚠️ #INCIBEaviso | Múltiples #vulnerabilidades en School ERP Pro+Responsive de #AROXSOLUTION. #AvisosDeSeguridad #0day #CNA #CVE CVE-2024-4822 CVE-2024-4823 CVE-2024-4824 https://t.co/g8Ip8lAaRy https://t.co/4keEej2L3C
0
0
0

Affected Software

No affected software found for this CVE

References

ReferenceLink
[email protected]https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-school-erp-proresponsive-arox-solution

CWE Details

CWE IDCWE NameDescription
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVE Radar

Real-time CVE Intelligence & Vulnerability Management Platform

CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.

Get Free Vulnerability Intelligence AccessAccess real-time CVE monitoring, exploit analysis, and threat intelligence