{"id":"CVE-2026-124498","kind":"vulnerability","aliases":["CVE-2026-124498"],"related":[],"title":"Convene Board Portal: REDIRECT_URL parameter enables cross-site scripting attacks","description":"A vulnerability was determined in Convene Azeus Convene Board Management Portal 7.0.2.7_3 p72. The impacted element is an unknown function of the file /jsp/ge/dummy_launcher.jsp. Executing a manipulation of the argument REDIRECT_URL can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"The Convene Azeus board management portal version 7.0.2.7_3 p72 fails to sanitize the REDIRECT_URL argument in /jsp/ge/dummy_launcher.jsp. An attacker can use a crafted link to run scripts in a victim's browser session.","severity":"medium","cvss":4.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["board-portal","convene","java","jsp","vendor"],"not_affected_if":["no-jsp-launcher","other-versions"],"how_to_check":"- Check whether the portal runs version `7.0.2.7_3 p72` or a nearby build, using the vendor's version information.\n- Confirm whether the path `/jsp/ge/dummy_launcher.jsp` exists on the portal.","fix":null,"status":"open","published_at":"2026-11-08T23:16:34+00:00","first_seen_at":"2026-11-08T23:23:21+00:00","triaged_at":"2026-11-08T23:24:29+00:00","updated_at":"2026-11-08T23:24:29+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-11-08T23:24:29Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Convene Board Portal: REDIRECT_URL parameter enables cross-site scripting attacks","impact":"medium","summary":"The Convene Azeus board management portal version 7.0.2.7_3 p72 fails to sanitize the REDIRECT_URL argument in /jsp/ge/dummy_launcher.jsp. An attacker can use a crafted link to run scripts in a victim's browser session.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["convene","board-portal","java","jsp"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs scripts in a user's browser session on the portal","analyst_note":"Vendor did not respond to disclosure; confirm whether a fixed version exists and whether the affected page is reachable externally.","how_to_check":"- Check whether the portal runs version `7.0.2.7_3 p72` or a nearby build, using the vendor's version information.\n- Confirm whether the path `/jsp/ge/dummy_launcher.jsp` exists on the portal.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["other-versions","no-jsp-launcher"],"who_is_affected":"Organizations that host or use the Convene Azeus board management portal and expose the dummy_launcher.jsp page to users. Whether the page is reachable from outside the network is not stated in the sources. The sources do not say whether other versions are affected.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000752,"input_tokens":4618,"output_tokens":581,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124498':15A,18A '-2026':14A,17A '/jsp/ge/dummy_launcher.jsp':44B,85C '3':34B,73C '7.0.2.7':33B,72C 'argument':42B,91C 'attack':12A,46B,101C 'azeus':28B,67C 'board':2A,20B,29B,69C 'board-port':19B 'browser':59B 'contact':119C 'conven':1A,22B,27B,66C,68C 'craft':50B 'cross':9A,97C 'cross-sit':8A 'cve':13A,16A 'determin':64C 'disclos':111C 'disclosur':123C 'earli':120C 'element':77C 'enabl':7A 'execut':86C 'exploit':107C 'fail':36B 'file':84C 'function':81C 'impact':76C 'java':23B 'jsp':24B 'launch':104C 'lead':95C 'link':51B 'manag':30B,70C 'manipul':88C 'may':113C 'p72':35B,74C 'paramet':6A 'portal':3A,21B,31B,71C 'public':110C 'redirect':4A,40B,92C 'remot':105C 'respond':127C 'run':53B 'sanit':38B 'script':11A,54B,99C 'session':60B 'site':10A,98C 'unknown':80C 'url':5A,41B,93C 'use':48B 'util':115C 'vendor':25B,117C 'version':32B 'victim':57B 'vulner':62C 'way':130C","nicknames":[],"mitigations":[],"who_affected":"Organizations that host or use the Convene Azeus board management portal and expose the dummy_launcher.jsp page to users. Whether the page is reachable from outside the network is not stated in the sources. The sources do not say whether other versions are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["boardportal","convene","java","jsp","medium","vendor"],"campaign_type":null,"search_a":"'-124498':15A,18A '-2026':14A,17A 'attack':12A 'board':2A 'conven':1A 'cross':9A 'cross-sit':8A 'cve':13A,16A 'enabl':7A 'paramet':6A 'portal':3A 'redirect':4A 'script':11A 'site':10A 'url':5A","search_b":"'/jsp/ge/dummy_launcher.jsp':44B '3':34B '7.0.2.7':33B 'argument':42B 'attack':46B 'azeus':28B 'board':20B,29B 'board-port':19B 'browser':59B 'conven':22B,27B 'craft':50B 'fail':36B 'java':23B 'jsp':24B 'link':51B 'manag':30B 'p72':35B 'portal':21B,31B 'redirect':40B 'run':53B 'sanit':38B 'script':54B 'session':60B 'url':41B 'use':48B 'vendor':25B 'version':32B 'victim':57B","search_c":"'/jsp/ge/dummy_launcher.jsp':85C '3':73C '7.0.2.7':72C 'argument':91C 'attack':101C 'azeus':67C 'board':69C 'contact':119C 'conven':66C,68C 'cross':97C 'determin':64C 'disclos':111C 'disclosur':123C 'earli':120C 'element':77C 'execut':86C 'exploit':107C 'file':84C 'function':81C 'impact':76C 'launch':104C 'lead':95C 'manag':70C 'manipul':88C 'may':113C 'p72':74C 'portal':71C 'public':110C 'redirect':92C 'remot':105C 'respond':127C 'script':99C 'site':98C 'unknown':80C 'url':93C 'util':115C 'vendor':117C 'vulner':62C 'way':130C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T23:16:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124498","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124498","severity":null,"published_at":"2026-11-08T23:16:34+00:00","modified_at":"2026-11-08T23:16:34+00:00","first_seen_at":"2026-11-08T23:23:21+00:00","fetched_at":"2026-11-08T23:23:21+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}