Stored Cross-Site Scripting (XSS) vulnerability discovered in the Properties Component of JATOS v3.9.3. This flaw allows an attacker to inject malicious JavaScript into the properties section of a study, specifically within the UUID field. When an admin user accesses the study's properties, the injected script is executed in the admin's browser, which could lead to unauthorized actions, including account compromise and privilege escalation.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://hacking-notes.medium.com/cve-2024-51380-jatos-v3-9-3-stored-xss-properties-component-44aea338ee9c | Exploit Third Party Advisory |
Configurations
History
24 Jun 2025, 13:22
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://hacking-notes.medium.com/cve-2024-51380-jatos-v3-9-3-stored-xss-properties-component-44aea338ee9c - Exploit, Third Party Advisory | |
| CPE | cpe:2.3:a:jatos:jatos:3.9.3:*:*:*:*:*:*:* | |
| First Time |
Jatos jatos
Jatos |
05 Nov 2024, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-11-05 19:15
Updated : 2025-06-24 13:22
NVD link : CVE-2024-51380
Mitre link : CVE-2024-51380
JSON object : View
Products Affected
jatos
- jatos
CWE
No CWE.