What is CVE-2022-39020?

CVE-2022-39020 is a high-severity vulnerability in Schoolbox, classified under Cross-site Scripting. CVSS score: 7.6/10. Published 2022-10-31.

How severe is CVE-2022-39020?

High severity. CVSS v3 base score is 7.6 out of 10.

XSS in Schoolbox

CVE-2022-39020

Multiple instances of XSS (stored and reflected) was found in the application. For example, features such as student assessment submission, file upload, news, ePortfolio and calendar event creation were found to be vulnerable to cross-site scripting.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.004 (32.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L.

Affected products

Schoolbox — versions 21.0.2
Schoolbox Pty Ltd — versions 21.0.2

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

vdp@themissinglink.com.au (Third Party Advisory)

Frequently asked questions

What is CVE-2022-39020?: CVE-2022-39020 is a high-severity vulnerability in Schoolbox, classified under Cross-site Scripting. CVSS score: 7.6/10. Published 2022-10-31.
How severe is CVE-2022-39020?: High severity. CVSS v3 base score is 7.6 out of 10.