CVE-2024-3138

Vulnerability

Description A disputed cross-site scripting (XSS) vulnerability exists in RosarioSIS 11.5.1, specifically in the Add Portal Note component. The issue allows manipulation leading to XSS, though the vendor argues that PDFs generated are opened in a browser sandbox, preventing access to website data [1].

Exploitation

The attack can be initiated remotely, but it requires user interaction to trigger the malicious script. No authentication is mentioned as necessary, but typical XSS exploits rely on an authenticated user viewing the crafted note [1].

Impact

The CVSS v3 base score is 3.5 (Low), reflecting the disputed nature and the vendor's claim that data exposure is limited due to sandboxing. If the vendor's assertion is incorrect, an attacker could potentially execute scripts in the context of the user's session, though the official dispute suggests limited practical impact [1].

Mitigation

As of the publication date, no patch has been released. The vendor disputes the vulnerability, so users should monitor for updates or implement additional input sanitization. Given the low severity and dispute, the risk may be acceptable for many deployments [1][2].