Stored Cross-site Scripting Vulnerability in ILIAS Product
CVE-2024-33526

7.1HIGH

Key Information:

Vendor

ILIAS

Status
Ilias
Vendor
CVE Published:
21 May 2024

What is CVE-2024-33526?

A Stored Cross-site Scripting (XSS) vulnerability exists within the 'Import of user role and title of user role' feature in the ILIAS Learning Management System. This vulnerability allows remote authenticated attackers with administrative privileges to upload XML files that contain arbitrary web scripts or HTML. It poses a significant security risk as attackers can exploit this weakness to execute malicious code within the context of the user's session, potentially compromising sensitive information and overall system integrity.

References

https://docu.ilias.de/ilias.php?baseClass=illmpresentatio...
https://insinuator.net/2024/05/security-advisory-achievin...

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.