PT-2024-25295 · Ilias · Ilias

Daniel Schlecht · Published 2024-05-21 · Updated 2024-07-03 · CVE-2024-33525

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions ILIAS versions 7.20 through 7.29 ILIAS versions 8.4 through 8.10 ILIAS version 9.0

Description A Stored Cross-site Scripting (XSS) vulnerability in the "Import of organizational units and title of organizational unit" feature allows remote authenticated attackers with administrative privileges to inject arbitrary web script or HTML via XML file upload.

Recommendations For ILIAS versions 7.20 through 7.29, update to a version outside of this range to mitigate the risk. For ILIAS versions 8.4 through 8.10, update to a version outside of this range to mitigate the risk. For ILIAS version 9.0, update to a newer version to mitigate the risk.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-33525

Affected Products

Ilias

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-33525 · Security Note
• https://docu.ilias.de/ilias.php?baseClass=illmpresentationgui&cmd=layout&ref_id=1719&obj_id=170040 · Note
• https://t.me/cvenotify/80682 · Telegram Post
• https://t.me/cvenotify/80889 · Telegram Post
• https://insinuator.net/2024/05/security-advisory-achieving-php-code-execution-in-ilias-elearning-lms-before-v7-30-v8-11-v9-1 · Note
• https://docu.ilias.de/ilias.php?baseClass=illmpresentationgui&cmd=layout&ref_id=1719&obj_id=159938 · Note
• https://docu.ilias.de/ilias.php?baseClass=illmpresentationgui&cmd=layout&ref_id=1719&obj_id=170029 · Note
• https://twitter.com/CVEnew/status/1793284032379388118 · Twitter Post
• https://t.me/cvenotify/80612 · Telegram Post