PT-2022-20930 · Idealms · Idealms

Mohammad Reza Ismaeli Taba · Published 2022-06-21 · Updated 2022-06-28 · CVE-2022-31786

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions IdeaLMS version 2022

Description The issue allows reflected Cross Site Scripting (XSS) via the IdeaLMS/Class/Assessment/ PATH INFO. This means an attacker can inject malicious scripts into the website, potentially stealing user data or taking control of user sessions.

Recommendations For IdeaLMS version 2022, update to a version that fixes the reflected Cross Site Scripting issue, or as a temporary workaround, consider restricting access to the IdeaLMS/Class/Assessment/ PATH INFO to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-31786

Affected Products

Idealms

References · 4

• 🔥 https://gist.github.com/RNPG/e10524f1781a9981b50fb27bb473b0fe · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-31786 · Security Note
• https://osv.dev/vulnerability/CVE-2022-31786 · Vendor Advisory
• https://t.me/cibsecurity/44897 · Telegram Post