« Volver al listado

CVE-2020-9008

Estado: ModificadaMedia (5.4)—

Stored Cross-site scripting (XSS) vulnerability in Blackboard Learn/PeopleTool v9.1 allows users to inject arbitrary web script via the Tile widget in the People Tool profile editor.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Blackboard — Blackboard Learn

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-9008",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-02-25T18:15:11.270",
  "references": [
    {
      "url": "https://blackboard.com",
      "tags": [
        "Product"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/kyletimmermans/blackboard-xss/blob/master/CVE-2020-9008.md",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://blackboard.com",
      "tags": [
        "Product"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/kyletimmermans/blackboard-xss/blob/master/CVE-2020-9008.md",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Stored Cross-site scripting (XSS) vulnerability in Blackboard Learn/PeopleTool v9.1 allows users to inject arbitrary web script via the Tile widget in the People Tool profile editor."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de tipo Cross-site scripting (XSS) Almacenado en Blackboard Learn/PeopleTool versión v9.1, permite a usuarios inyectar script web arbitrario por medio del widget Tile en el editor de perfiles de People Tool."
    }
  ],
  "lastModified": "2026-06-17T03:27:20.103",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:blackboard:blackboard_learn:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4513A58A-7F20-409E-B651-EBA0FD9920E5",
              "versionEndExcluding": "9.1"
            },
            {
              "criteria": "cpe:2.3:a:blackboard:blackboard_learn:9.1:q2_2017:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "241DD4F3-BD1C-45AB-9F33-6F795BC87506"
            },
            {
              "criteria": "cpe:2.3:a:blackboard:blackboard_learn:9.1:q2_2017_cumulative_update1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A4E7B568-B8BB-4DD6-AAA8-1C6F40B26AF4"
            },
            {
              "criteria": "cpe:2.3:a:blackboard:blackboard_learn:9.1:q2_2017_cumulative_update2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EFBB0B68-E0CD-43FD-B64A-E01E05301E0F"
            },
            {
              "criteria": "cpe:2.3:a:blackboard:blackboard_learn:9.1:q2_2017_cumulative_update3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "43810023-07FA-4802-B770-71BF2EEA9D3F"
            },
            {
              "criteria": "cpe:2.3:a:blackboard:blackboard_learn:9.1:q2_2017_cumulative_update4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "60884232-4C41-45C0-857A-C02CBDC48A37"
            },
            {
              "criteria": "cpe:2.3:a:blackboard:blackboard_learn:9.1:q2_2017_cumulative_update5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "30C4A6AE-971B-474D-9721-7C8B88E7675F"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}