Exploitation Summary
EIP tracks 1 public exploit for CVE-2023-2822. PoCs published by cberman. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional Flask application demonstrating CVE-2023-2822, a reflected XSS vulnerability in Ellucian Ethos Identity CAS logout page. The app intentionally includes a vulnerable endpoint that reflects user input without proper sanitization, allowing XSS exploitation.
Description
A vulnerability was found in Ellucian Ethos Identity up to 5.10.5. It has been classified as problematic. Affected is an unknown function of the file /cas/logout. The manipulation of the argument url leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 5.10.6 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-229596.
Exploits (1)
This repository contains a functional Flask application demonstrating CVE-2023-2822, a reflected XSS vulnerability in Ellucian Ethos Identity CAS logout page. The app intentionally includes a vulnerable endpoint that reflects user input without proper sanitization, allowing XSS exploitation.
Nuclei Templates (1)
html:"Ellucian Company" || http.html:"ellucian company"
body="ellucian company"
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N