PT-2022-19569 · Unknown · Academy Lms

Published 2022-05-25 · Updated 2022-06-02 · CVE-2022-29380

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Academy-LMS version 4.3

Description A stored cross-site scripting (XSS) issue was found in the SEO panel of Academy-LMS. This type of issue allows attackers to inject malicious scripts into content, which are then stored on the server and executed by the browser when other users access the affected page.

Recommendations For Academy-LMS version 4.3, update to a version that includes a fix for the stored cross-site scripting vulnerability in the SEO panel. As a temporary workaround, consider restricting access to the SEO panel to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-29380

Affected Products

Academy Lms

References · 5

• 🔥 https://exploit-db.com/exploits/49298 · Exploit
• https://osv.dev/vulnerability/CVE-2022-29380 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29380 · Security Note
• https://t.me/cvenotify/30704 · Telegram Post
• https://t.me/cibsecurity/43337 · Telegram Post