CVE-2017-15538

MEDIUM

ILIAS < 5.1.21 and 5.2.x < 5.2.9 - Authenticated Stored Cross-Site Scripting in Media Objects

Title source: llm
STIX 2.1

Description

Stored XSS vulnerability in the Media Objects component of ILIAS before 5.1.21 and 5.2.x before 5.2.9 allows an authenticated user to inject JavaScript to gain administrator privileges, related to the setParameter function in Services/MediaObjects/classes/class.ilMediaItem.php.

References (5)

Core 5
Core References
Issue Tracking, Release Notes, Vendor Advisory x_refsource_misc
https://www.ilias.de/docu/goto_docu_pg_75377_35.html
Mailing List, Patch, Third Party Advisory x_refsource_misc
http://openwall.com/lists/oss-security/2017/10/17/3
Issue Tracking, Release Notes, Vendor Advisory x_refsource_misc
https://www.ilias.de/docu/goto_docu_pg_75378_1719.html

Scores

CVSS v3 5.4
EPSS 0.0094
EPSS Percentile 56.5%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (1)
ilias/ilias < 5.1.21
Published Oct 17, 2017
Tracked Since Feb 18, 2026