What this actually is.
Technical background, root cause, and affected surface.
Versions of Follett School Solutions Destiny Library manager before v22.0.1 AU1 are affected by a reflected cross-site scripting vulnerability. Due to this vulnerability, if the application is accessed through an attacker-controlled link, the attacker can display arbitrary (potentially hostile and dangerous) content in the context of the otherwise legitimate website.
- Vendor
- Follett School Solutions
- Affected Product
- Destiny Library Manager
- CVE
- CVE-2024-47095
- Securin ID
- -
- Status
- Fixed
- Date
- September 26, 2024
- Severity
- Medium
- CVSS Score
- 5.1
- CWE
- CWE-79
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
We tested the following vulnerability on a deployment of Follett School Solutions Destiny Library Manager version 21.2.0 RC2.
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
If a user accesses the vulnerable application through an attacker controlled link, the attacker can arbitrarily modify the contents of the site as displayed to the victim user. This can be abused to achieve a form of vandalism, to spread misinformation, and to steal any passwords users may submit to the site.
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Encode special characters prior to reflecting them in an HTML or JavaScript context via server-side templating.
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Securin discovers the vulnerability in Follett School Solutions Destiny Library Manager version 21.2.0 RC2.
Securin reports the vulnerability to Follett School Solutions. Follett acknowledges they have received the report and states that they will investigate the issue.
Follett acknowledges the issue and reports they are working on establishing timing for releasing an official fix.
Follett shares that the official fix will be included in an update to the Destiny software on August 16, 2024.
Follett releases an official fix for the vulnerability.
Timeline recorded · Disclosure coordinated by Securin
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.