CVE-2026-124498 · Vendor
NO FIX YET
The Convene Azeus board management portal version 7.0.2.7_3 p72 fails to sanitize the REDIRECT_URL argument in /jsp/ge/dummy_launcher.jsp. An attacker can use a crafted link to run scripts in a victim's browser session.
first public Nov 8, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organizations that host or use the Convene Azeus board management portal and expose the dummy_launcher.jsp page to users. Whether the page is reachable from outside the network is not stated in the sources. The sources do not say whether other versions are affected.
Not affected if no-jsp-launcher, other-versions
Who cares board-portal, convene, java, jsp
7.0.2.7_3 p72 or a nearby build, using the vendor's version information./jsp/ge/dummy_launcher.jsp exists on the portal.No fix yet, per the sources.
A vulnerability was determined in Convene Azeus Convene Board Management Portal 7.0.2.7_3 p72. The impacted element is an unknown function of the file /jsp/ge/dummy_launcher.jsp. Executing a manipulation of the argument REDIRECT_URL can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.