« Volver al listado

CVE-2026-23880

Estado: AplazadaAlta (7.3)—

OnboardLite is a comprehensive membership lifecycle platform built for student organizations at the University of Central Florida. Versions of the software prior to commit 1d32081a66f21bcf41df1ecb672490b13f6e429f have a stored cross-site scripting vulnerability that can be rendered to an admin when they attempt to migrate a user's discord account in the dashboard. Commit 1d32081a66f21bcf41df1ecb672490b13f6e429f patches the issue.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

XSS almacenado renderizado en dashboard admin (AV:N, CWE-79). Ejecución de JavaScript en contexto navegador del administrador; requiere UI:R (interacción usuario para migración).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Restrict Web-Based ContentUser TrainingExecution PreventionBehavior Prevention on EndpointDisable or Remove Feature or ProgramApplication Isolation and Sandboxing

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Onboardlite — OnboardliteAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-23880",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-23880",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-01-20T15:12:18.083821Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.3,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.1
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "HackUCF",
          "product": "OnboardLite",
          "versions": [
            {
              "status": "affected",
              "version": "< 1d32081a66f21bcf41df1ecb672490b13f6e429f"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-01-19T21:15:52.357",
  "references": [
    {
      "url": "https://github.com/HackUCF/OnboardLite/commit/1d32081a66f21bcf41df1ecb672490b13f6e429f",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/HackUCF/OnboardLite/security/advisories/GHSA-93w8-83cg-h89g",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-79"
        },
        {
          "lang": "en",
          "value": "CWE-116"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "OnboardLite is a comprehensive membership lifecycle platform built for student organizations at the University of Central Florida. Versions of the software prior to commit 1d32081a66f21bcf41df1ecb672490b13f6e429f have a stored cross-site scripting vulnerability that can be rendered to an admin when they attempt to migrate a user's discord account in the dashboard. Commit 1d32081a66f21bcf41df1ecb672490b13f6e429f patches the issue."
    },
    {
      "lang": "es",
      "value": "OnboardLite es una plataforma integral para el ciclo de vida de la membresía construida para organizaciones estudiantiles en la Universidad de Florida Central. Las versiones del software anteriores al commit 1d32081a66f21bcf41df1ecb672490b13f6e429f tienen una vulnerabilidad de cross-site scripting almacenado que puede ser renderizada a un administrador cuando intenta migrar la cuenta de Discord de un usuario en el panel de control. El commit 1d32081a66f21bcf41df1ecb672490b13f6e429f corrige el problema."
    }
  ],
  "lastModified": "2026-06-17T10:22:14.780",
  "sourceIdentifier": "security-advisories@github.com"
}