PT-2022-7073 · Ilias · Ilias

Anna Hartig + 2 · Published 2022-09-30 · Updated 2023-01-06 · CVE-2022-45917

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions ILIAS versions prior to 7.16

Description The issue is related to an open redirect in the shib logout.php script, specifically with the handling of the return parameter. This could allow a remote attacker to redirect users to an arbitrary URL.

Recommendations For versions prior to 7.16, update to version 7.16 or later to resolve the issue. As a temporary workaround, consider restricting access to the shib logout.php script to minimize the risk of exploitation. Avoid using the return parameter in the affected script until the issue is resolved.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

BDU:2023-07495

CVE-2022-45917

Affected Products

Ilias

References · 6

• 🔥 http://seclists.org/fulldisclosure/2022/Dec/7 · Exploit
• 🔥 https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-ilias-elearning-platform · Exploit
• 🔥 http://packetstormsecurity.com/files/170181/ILIAS-eLearning-7.15-Command-Injection-XSS-LFI-Open-Redirect.html · Exploit
• https://osv.dev/vulnerability/CVE-2022-45917 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07495 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-45917 · Security Note