CVE-2021-40492: 
NixOS vulnerability analysis and mitigation

A reflected Cross-Site Scripting (XSS) vulnerability was discovered in version 22 of the Gibbon education application. The vulnerability was disclosed on September 3, 2021, and assigned identifier CVE-2021-40492. The vulnerability affects multiple pages within the application and allows attackers to execute arbitrary JavaScript code through various parameters (NIST, MITRE).

The vulnerability exists in multiple parameters including gibbonCourseClassID, gibbonPersonID, subpage, currentDate, and allStudents when passed to index.php. These parameters are not properly sanitized before being reflected back to users. The vulnerability has been assigned a CVSS v3.1 base score of 6.1 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (NIST, GitHub).

Successful exploitation of this vulnerability could allow attackers to execute arbitrary JavaScript code in victims' browsers in the context of the vulnerable site. This could potentially lead to theft of session tokens, cookie theft, and other client-side attacks (NIST).

Users should upgrade to a version newer than Gibbon version 22. The vulnerability has been reported to the vendor and should be patched in subsequent releases (Vendor Advisory).