---
id: "CVE-2026-124498"
page: "https://infrastack.ai/live/CVE-2026-124498"
kind: "vulnerability"
aliases: ["CVE-2026-124498"]
title: "Convene Board Portal: REDIRECT_URL parameter enables cross-site scripting attacks"
severity: "medium"
cvss: 4.0
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["board-portal", "convene", "java", "jsp", "vendor"]
not_affected_if: ["no-jsp-launcher", "other-versions"]
published_at: "2026-11-08T23:16:34+00:00"
first_seen_at: "2026-11-08T23:23:21+00:00"
updated_at: "2026-11-08T23:24:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124498", "first_seen_at": "2026-11-08T23:23:21+00:00"}]
exploit_sources: []
---

# Convene Board Portal: REDIRECT_URL parameter enables cross-site scripting attacks

Link for people: https://infrastack.ai/live/CVE-2026-124498 (this .md is for agents)

The Convene Azeus board management portal version 7.0.2.7_3 p72 fails to sanitize the REDIRECT_URL argument in /jsp/ge/dummy_launcher.jsp. An attacker can use a crafted link to run scripts in a victim's browser session.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the portal runs version `7.0.2.7_3 p72` or a nearby build, using the vendor's version information.
- Confirm whether the path `/jsp/ge/dummy_launcher.jsp` exists on the portal.

## Timeline

- 2026-11-08T23:23:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124498

## From the sources

A vulnerability was determined in Convene Azeus Convene Board Management Portal 7.0.2.7_3 p72. The impacted element is an unknown function of the file /jsp/ge/dummy_launcher.jsp. Executing a manipulation of the argument REDIRECT_URL can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_