CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JobScore Job Manager job-manager-by-jobscore allows Stored XSS.This issue affects Job Manager: from n/a through <= 2.2.
Explanation of Vulnerability in Simple Terms
JobScore Job Manager versions 2.2 and earlier contain a cross-site scripting vulnerability that allows attackers with low-level user access to inject malicious scripts. When a victim visits a page containing the attacker's payload, the script executes in their browser with access to their session. The vulnerability affects multiple security functions and can impact site visitors across different user roles.
What an attacker can do
Inject malicious scripts that execute in other users' browsers and steal their session data or perform actions on their behalf.
Potential impact on your site
Site visitors' sessions can be compromised; attackers can perform unauthorized actions as those users or steal sensitive information.
Conditions required to exploit
Attacker needs a low-privilege user account and must trick a victim into visiting a page with the malicious payload.
Key dates
External resources
Related vulnerabilities
