CVE-2024-47096: Reflected Cross-Site Scripting in Follett School Solutions Destiny Library Manager

01/Description

What this actually is.

Technical background, root cause, and affected surface.

Cross Site Scripting vulnerability in Follet School Solutions Destiny before v22.0.1 AU1 allows a remote attacker to run arbitrary client-side code via the showSupportExpiredMessage parameter of handleloginform.do.

Vendor: Follett School Solutions
Product: Destiny Library Manager
Severity: Medium
CVSS Score: 5.1
Status: Fixed
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CWE: CWE-79

02/References

Cite, verify, go deeper.

Primary sources — NVD, CISA KEV, and machine-readable IoC feed.

NVD

NVD — CVE-2024-47096

nvd.nist.gov/vuln/detail/CVE-2024-47096 →

SEC

Securin VI — Full Technical Analysis

vi.securin.io →

Reflected Cross-Site Scripting in Follett School Solutions Destiny Library Manager

What this actually is.

Cite, verify, go deeper.

NVD — CVE-2024-47096

Securin VI — Full Technical Analysis

Let Securin level up your security posture.