CVE-2024-22490: 
Java vulnerability analysis and mitigation

A Cross Site Scripting (XSS) vulnerability has been identified in beetl-bbs version 2.0, tracked as CVE-2024-22490. The vulnerability allows attackers to execute arbitrary code through the /index keyword parameter. This security flaw was discovered and disclosed in January 2024 (NVD).

The vulnerability is classified as a Cross Site Scripting (XSS) issue with a CVSS v3.1 base score of 6.1 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The flaw is specifically related to improper neutralization of input during web page generation (CWE-79) and exists in the search box functionality of the application (NVD).

When successfully exploited, this vulnerability allows remote attackers to inject arbitrary web script or HTML through the /index keyword parameter. Additionally, there is potential for information exposure as the cookie set after a successful user login contains an MD5 hash of the user's password, which could be leveraged for password cracking attempts through hash collision attacks (GitHub Security).

The vulnerability has been confirmed to be exploitable through the /index keyword parameter. A proof of concept exists that demonstrates the ability to execute arbitrary JavaScript code, specifically accessing document.cookie (GitHub Security).