PT-2018-9879 · Ilias · Ilias

Moritz Bechler · Publicado 2018-05-23 · Atualizado 2019-03-08 · CVE-2018-10428

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: ILIAS versions prior to 5.1.26 ILIAS versions 5.2.x prior to 5.2.15 ILIAS versions 5.3.x prior to 5.3.4

Description: The issue arises from inconsistencies in parameter handling, leading to instances of reflected cross-site-scripting.

Recommendations: For versions prior to 5.1.26, update to version 5.1.26 or later. For versions 5.2.x prior to 5.2.15, update to version 5.2.15 or later. For versions 5.3.x prior to 5.3.4, update to version 5.3.4 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-10428

Produtos afetados

Ilias

Referências · 9

• 🔥 http://packetstormsecurity.com/files/147726/ILIAS-5.3.2-5.2.14-5.1.25-Cross-Site-Scripting.html · Exploit
• 🔥 http://securityfocus.com/archive/1/542025/100/0/threaded · Exploit
• 🔥 https://syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2018-007.txt · Exploit
• https://ilias.de/docu/ilias.php?ref_id=1719&from_page=116805&obj_id=116799&cmd=layout&cmdClass=illmpresentationgui&cmdNode=wc&baseClass=ilLMPresentationGUI · Nota
• https://osv.dev/vulnerability/CVE-2018-10428 · Aviso do Fabricante
• https://ilias.de/docu/ilias.php?ref_id=1719&obj_id=116792&from_page=116805&cmd=layout&cmdClass=illmpresentationgui&cmdNode=wc&baseClass=ilLMPresentationGUI · Nota
• https://ilias.de/docu/ilias.php?ref_id=1719&from_page=116793&obj_id=116793&cmd=layout&cmdClass=illmpresentationgui&cmdNode=wc&baseClass=ilLMPresentationGUI · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10428 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-10428 · Nota de Segurança