Executive brief
Ellucian Banner Self-Service, a platform used by higher education institutions for student and faculty administrative tasks, contains a security flaw in its course search feature. An authenticated user can inject malicious scripts into course or faculty information fields, which are then executed when other users view those records. This could allow an attacker to hijack user sessions, steal sensitive information, or perform unauthorized actions on behalf of faculty and staff.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Ellucian Banner Self-Service due to improper neutralization of input during web page generation (CWE-79). The vulnerability is located within the course search functionality, specifically where the application fails to perform HTML encoding during DOM insertion of data retrieved from the database. An attacker can leverage the unauthenticated 'getFacultyMeetingTimes' API endpoint to inject malicious JavaScript into various fields, including faculty displayName, emailAddress, subjectDescription, and courseTitle. When an authenticated user later views the affected course or faculty records, the stored script executes in the context of their browser session. This requires the attacker to have network access and at least low-level authenticated privileges to the ERP system to facilitate the injection, though the API endpoint itself is described as unauthenticated.
Affected products
- Ellucian Banner Self-Service Before April T2 release (2025-04-23)
Timeline
- 2025-04-23: patched: Fixed in April T2 release
- 2026-06-09: advisory: NVD and VulnCheck advisory published