PT-2024-25762 · Rocketsoft · Rocket Lms

Sergio Medeiros · Published 2024-05-16 · Updated 2024-07-10 · CVE-2024-34241

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Rocketsoft Rocket LMS version 1.9

Description A cross-site scripting (XSS) issue allows an administrator to store a JavaScript payload using the admin web interface when creating new courses and new course notifications, potentially compromising user sessions.

Recommendations For Rocketsoft Rocket LMS version 1.9, patch immediately and validate user input to mitigate the risk of exploitation. As a temporary workaround, consider restricting access to the admin web interface for creating new courses and course notifications until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-34241

Affected Products

Rocket Lms

References · 6

• 🔥 https://grumpz.net/cve-2024-34241-a-step-by-step-discovery-guide · Exploit
• 🔥 https://exploit-db.com/exploits/52018 · Exploit
• https://osv.dev/vulnerability/CVE-2024-34241 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-34241 · Security Note
• https://twitter.com/grumpzsux/status/1791322001166192776 · Twitter Post
• https://twitter.com/oktsec/status/1811024987219714062 · Twitter Post