PT-2025-3696 · Viwis Lms · Viwis Lms

Ralph Meier · Published 2025-01-08 · Updated 2025-01-08 · CVE-2024-8002

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions VIWIS LMS version 9.11

Description A vulnerability has been found in the File Upload component of VIWIS LMS, affecting an unknown functionality. The manipulation of the filename argument leads to cross-site scripting. The attack can be launched remotely. Upgrading to version 9.12 is able to address this issue.

Recommendations For VIWIS LMS version 9.11, upgrade to version 9.12 to address the issue. As a temporary workaround, consider restricting the use of the File Upload component until the upgrade is applied.

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2024-8002

Affected Products

Viwis Lms

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-8002 · Security Note
• https://vuldb.com/?ctiid.290767 · Note
• https://t.me/cvedetector/14665 · Telegram Post
• https://vuldb.com/?id.290767 · Note
• https://twitter.com/CVEnew/status/1876890038178598964 · Twitter Post
• https://t.me/cvenotify/106726 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1876987698642075650 · Twitter Post