PT-2009-2616 · Intralearn · Intralearn

Published 2009-09-01 · Updated 2009-09-03 · CVE-2008-7147

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions IntraLearn Software IntraLearn versions 2.1 through 4.2.3

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the outline and course parameters to the "library/description link.cfm" endpoint, or the records to display and the start parameters to the "library/courses catalog.cfm" endpoint.

Recommendations For IntraLearn Software IntraLearn versions 2.1 through 4.2.3, update to version 4.2.3 or later to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-7147

Affected Products

Intralearn

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2008-7147 · Security Note
• http://osvdb.org/42988 · Note
• http://osvdb.org/ref/42/intralearn-21-multiple.txt · Note
• http://osvdb.org/42989 · Note