CVEvulnerability
CVE-2017-15538
5.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2017-10-17
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 5.4 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Stored XSS vulnerability in the Media Objects component of ILIAS before 5.1.21 and 5.2.x before 5.2.9 allows an authenticated user to inject JavaScript to gain administrator privileges, related to the setParameter function in Services/MediaObjects/classes/class.ilMediaItem.php.
Affected configurations
• ilias ilias (<= 5.1.21)
• ilias ilias (>= 5.2.0 < 5.2.9)
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://openwall.com/lists/oss-security/2017/10/17/3 Mailing List, Patch, Third Party Advisory
- https://github.com/ILIAS-eLearning/ILIAS/commit/b2a4660afec1e87d41c83c8e381f549bc6dfc70f Issue Tracking, Patch, Third Party Advisory
- https://lists.ilias.de/pipermail/ilias-admins/2017-October/000053.html Vendor Advisory
- https://www.ilias.de/docu/goto_docu_pg_75377_35.html Issue Tracking, Release Notes, Vendor Advisory
- https://www.ilias.de/docu/goto_docu_pg_75378_1719.html Issue Tracking, Release Notes, Vendor Advisory
- http://openwall.com/lists/oss-security/2017/10/17/3 Mailing List, Patch, Third Party Advisory
- https://github.com/ILIAS-eLearning/ILIAS/commit/b2a4660afec1e87d41c83c8e381f549bc6dfc70f Issue Tracking, Patch, Third Party Advisory
- https://lists.ilias.de/pipermail/ilias-admins/2017-October/000053.html Vendor Advisory
- https://www.ilias.de/docu/goto_docu_pg_75377_35.html Issue Tracking, Release Notes, Vendor Advisory
- https://www.ilias.de/docu/goto_docu_pg_75378_1719.html Issue Tracking, Release Notes, Vendor Advisory