This vulnerability (CVE-2024-34428) in Harknell AWSOM News Announcement involves improper input sanitization leading to stored cross-site scripting (CWE-79). Attackers can inject malicious scripts that persist on the server and execute in the context of users' browsers. The vulnerability affects versions up to 1.6.0. The product is cloud-hosted, and the vendor is responsible for patching. The CVSS score of 5.9 reflects a medium severity with network attack vector, low attack complexity, high privileges required, and user interaction needed.

Successful exploitation could allow an attacker with high privileges to inject malicious scripts that execute in other users' browsers, potentially leading to limited confidentiality, integrity, and availability impacts. The medium CVSS score reflects these moderate risks. No known active exploitation has been reported.

Since AWSOM News Announcement is a cloud service, the vendor manages remediation and patch deployment server-side. Users should verify with the vendor advisory for confirmation of patch application. No direct user action is required unless otherwise instructed by the vendor. Patch status is confirmed as available, but no specific patch links are provided in the data.