Description
Vulnerability in AMSS++ version 4.31, which does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting (XSS) vulnerability through /amssplus/modules/book/main/bookdetail_group.php, in the 'b_id' parameter. This vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials.
Published: 2024-03-18
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2024-27542 Vulnerability in AMSS++ version 4.31, which does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting (XSS) vulnerability through /amssplus/modules/book/main/bookdetail_group.php, in the 'b_id' parameter. This vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials.
History

Thu, 17 Apr 2025 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Amss\+\+ Project
Amss\+\+ Project amss\+\+
CPEs cpe:2.3:a:amss\+\+_project:amss\+\+:4.31:*:*:*:*:*:*:*
Vendors & Products Amss\+\+ Project
Amss\+\+ Project amss\+\+

Subscriptions

Amss\+\+ Project Amss\+\+
cve-icon MITRE

Status: PUBLISHED

Assigner: INCIBE

Published:

Updated: 2024-08-01T19:18:48.177Z

Reserved: 2024-03-18T11:08:59.375Z

Link: CVE-2024-2593

cve-icon Vulnrichment

Updated: 2024-08-01T19:18:48.177Z

cve-icon NVD

Status : Analyzed

Published: 2024-03-18T14:15:12.233

Modified: 2026-06-17T07:24:51.127

Link: CVE-2024-2593

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')