TI-2020-07228 Aliases CVE-2020-9008 GHSA-hf77-c8vc-7pmp

Stored Cross-site scripting (XSS) vulnerability in Blackboard Learn/PeopleTool v9.1…

LOW 25CWE-79Published 2020-02-25 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Stored Cross-site scripting (XSS) vulnerability in Blackboard Learn/PeopleTool v9.1 allows users to inject arbitrary web script via the Tile widget in the People Tool profile editor.

Why it matters now

EPSS 0.00617 49th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 7

CPE	Versions	Role	Vendor
cpe:2.3:a:blackboard:blackboard_learn::::::::	before 9.1	Vulnerable	Blackboard
cpe:2.3:a:blackboard:blackboard_learn:9.1:q2_2017::::::	9.1 q2_2017	Vulnerable	Blackboard
cpe:2.3:a:blackboard:blackboard_learn:9.1:q2_2017_cumulative_update1::::::	9.1 q2_2017_cumulative_update1	Vulnerable	Blackboard
cpe:2.3:a:blackboard:blackboard_learn:9.1:q2_2017_cumulative_update2::::::	9.1 q2_2017_cumulative_update2	Vulnerable	Blackboard
cpe:2.3:a:blackboard:blackboard_learn:9.1:q2_2017_cumulative_update3::::::	9.1 q2_2017_cumulative_update3	Vulnerable	Blackboard
cpe:2.3:a:blackboard:blackboard_learn:9.1:q2_2017_cumulative_update4::::::	9.1 q2_2017_cumulative_update4	Vulnerable	Blackboard
cpe:2.3:a:blackboard:blackboard_learn:9.1:q2_2017_cumulative_update5::::::	9.1 q2_2017_cumulative_update5	Vulnerable	Blackboard

cpe:2.3:a:blackboard:blackboard_learn:*:*:*:*:*:*:*:* Versions before 9.1 Vulnerable ·Blackboard
cpe:2.3:a:blackboard:blackboard_learn:9.1:q2_2017:*:*:*:*:*:* Versions 9.1 q2_2017 Vulnerable ·Blackboard
cpe:2.3:a:blackboard:blackboard_learn:9.1:q2_2017_cumulative_update1:*:*:*:*:*:* Versions 9.1 q2_2017_cumulative_update1 Vulnerable ·Blackboard
cpe:2.3:a:blackboard:blackboard_learn:9.1:q2_2017_cumulative_update2:*:*:*:*:*:* Versions 9.1 q2_2017_cumulative_update2 Vulnerable ·Blackboard
cpe:2.3:a:blackboard:blackboard_learn:9.1:q2_2017_cumulative_update3:*:*:*:*:*:* Versions 9.1 q2_2017_cumulative_update3 Vulnerable ·Blackboard
cpe:2.3:a:blackboard:blackboard_learn:9.1:q2_2017_cumulative_update4:*:*:*:*:*:* Versions 9.1 q2_2017_cumulative_update4 Vulnerable ·Blackboard
cpe:2.3:a:blackboard:blackboard_learn:9.1:q2_2017_cumulative_update5:*:*:*:*:*:* Versions 9.1 q2_2017_cumulative_update5 Vulnerable ·Blackboard

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2020-9008
2026-10-03 Alias added: GHSA-hf77-c8vc-7pmp

References

Exploit 1

https://github.com/kyletimmermans/blackboard-xss/blob/master/CVE-2020-9008.md

Other 1

https://blackboard.com

TI-2022-18576 Blackboard Learn 1.10.1 allows remote authenticated users to read unintended files by… CVSS 3.1MEDIUM 6.5
TI-2018-09525 The bb-auth-provider-cas authentication module within Blackboard Learn 2018-07-02 is… CVSS 3.1MEDIUM 6.1
TI-2017-13447 Blackboard Learn (Since at least 17th of October 2017) has allowed Unvalidated Redirects… CVSS 3.0MEDIUM 6.1
TI-2021-14872 Blackboard Learn through 9.1 allows XSS by an authenticated user via the Feedback to Learner form. CVSS 3.1MEDIUM 5.4
TI-2021-14871 Blackboard Learn through 9.1 allows XSS by an authenticated user via the Assignment Instructions HTML editor. CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences