CVE-2007-5227
Multiple cross-site scripting (XSS) vulnerabilities in messaging/course/composeMessage.jsp in BlackBoard Learning System 6.3.1.593 and earlier in BlackBoard Academic Suite allow remote attackers to inject arbitrary web script or HTML via the (1)…
Does this matter?
Lower severity and a low EPSS score (1.07%). Track it; it rarely justifies an emergency change on its own.
Description
Multiple cross-site scripting (XSS) vulnerabilities in messaging/course/composeMessage.jsp in BlackBoard Learning System 6.3.1.593 and earlier in BlackBoard Academic Suite allow remote attackers to inject arbitrary web script or HTML via the (1) subject_t and (2) body_text parameters. NOTE: vector 2 requires bypassing a client-side security mechanism that attempts to block XSS sequences.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 1.07% probability · 63th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- blackboard/blackboard learning and community post systems
- Source
- cve@mitre.org
References
- http://osvdb.org/37427
- http://secunia.com/advisories/27005Vendor Advisory
- http://trew.icenetx.net/toolz/advisory-blackboard-messages-en.txt
- http://www.securityfocus.com/bid/25929
- http://osvdb.org/37427
- http://secunia.com/advisories/27005Vendor Advisory
- http://trew.icenetx.net/toolz/advisory-blackboard-messages-en.txt
- http://www.securityfocus.com/bid/25929
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.