PT-2024-25170 · Gunet · Gunet Openeclass E-Learning Platform

Published 2024-06-13 · Updated 2024-08-07 · CVE-2024-33253

Positive Technologies (AI Summary)

CVSS v3.1

6.0

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions GUnet OpenEclass E-learning Platform versions 3.15 and before

Description The issue is a cross-site scripting (XSS) vulnerability that allows an authenticated privileged attacker to execute arbitrary code. This can be achieved via the title and description fields of the badge template editing function.

Recommendations For versions 3.15 and before, consider disabling the badge template editing function until a patch is available to prevent exploitation. Restrict access to the title and description fields in the badge template editing function to minimize the risk of arbitrary code execution.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-33253

Affected Products

Gunet Openeclass E-Learning Platform

References · 4

• 🔥 https://github.com/FreySolarEye/CVE/blob/master/GUnet%20OpenEclass%20E-learning%20platform%203.15%20-%20%27certbadge.php%27%20Stored%20Cross%20Site%20Scripting · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-33253 · Security Note
• https://osv.dev/vulnerability/CVE-2024-33253 · Vendor Advisory
• https://twitter.com/CVEnew/status/1801673857717436498 · Twitter Post