PT-2020-7267 · Dokeos · Dokeos

Marcela Benetrix · Published 2020-01-29 · Updated 2020-01-31 · CVE-2012-5776

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Dokeos version 2.1.1

Description: The issue involves multiple XSS problems related to extra parameters in the main/auth/profile.php file. This could potentially allow attackers to execute malicious scripts.

Recommendations: For Dokeos version 2.1.1, consider restricting access to the main/auth/profile.php file or disabling the use of extra parameters until a fix is available. Avoid using the extra parameters in the affected file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2012-5776

Affected Products

Dokeos

References · 5

• 🔥 https://cxsecurity.com/issue/WLB-2012110007 · Exploit
• 🔥 http://openwall.com/lists/oss-security/2012/11/02/10 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-5776 · Security Note
• https://t.me/cvenotify/588 · Telegram Post
• https://t.me/cibsecurity/9479 · Telegram Post