Cross Site Scripting in Ellucian Banner Student Registration Self-Service

Executive Summary

CVE-2026-38671 is a reflected Cross-Site Scripting (XSS) vulnerability in Ellucian Banner Student Registration Self-Service versions 9.23 and prior. It allows a remote attacker to execute arbitrary JavaScript code in a victim's browser by tricking them into clicking a malicious link. The attack leverages the mepCode parameter in the /ssb/registration endpoint, which reflects user input without proper encoding.

Useful 0 Not Useful 0

Detection Guidance

To detect this reflected XSS vulnerability, monitor web traffic for requests to the /ssb/registration endpoint with the mepCode parameter. Look for unusual input in the parameter that may contain script tags or JavaScript code. Use tools like Burp Suite or OWASP ZAP to intercept and inspect requests for suspicious payloads.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing attackers to manipulate the application's user interface, perform actions within your authenticated session, or access information exposed to JavaScript in your browser. Successful exploitation requires you to click a malicious link but does not require authentication in some cases.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the latest supported releases from Ellucian as identified in Product Defect PD0033258. Ensure proper output encoding is implemented for all user-supplied input in the mepCode parameter. Disable or restrict access to the /ssb/registration endpoint if not required.

Useful 0 Not Useful 0