Lucene search
HistoryMay 21, 2024 - 7:15 p.m.
CVE-2024-33525
stored cross-site scripting
ilias
xml file upload
remote attackers
administrative privileges
A Stored Cross-site Scripting (XSS) vulnerability in the “Import of organizational units and title of organizational unit” feature in ILIAS 7.20 to 7.29 and ILIAS 8.4 to 8.10 as well as ILIAS 9.0 allows remote authenticated attackers with administrative privileges to inject arbitrary web script or HTML via XML file upload.
References
docu.ilias.de/ilias.php?baseClass=illmpresentationgui&cmd=layout&ref_id=1719&obj_id=159938
docu.ilias.de/ilias.php?baseClass=illmpresentationgui&cmd=layout&ref_id=1719&obj_id=170029
docu.ilias.de/ilias.php?baseClass=illmpresentationgui&cmd=layout&ref_id=1719&obj_id=170040
insinuator.net/2024/05/security-advisory-achieving-php-code-execution-in-ilias-elearning-lms-before-v7-30-v8-11-v9-1/
Related
vulnrichment
vulnrichment
CVE-2024-33525
1976-01-01 00:00:00
nvd
nvd
CVE-2024-33525
2024-05-21 19:15:10
cvelist
cvelist
CVE-2024-33525
1976-01-01 00:00:00