CVE-2024-28147

HIGH

edu-sharing <8.0.8-RC2, <8.1.4-RC0, <9.0.0-RC19 - Arbitrary File Upload & Stored XSS via Collection Preview Image

Title source: llm
STIX 2.1

Description

An authenticated user can upload arbitrary files in the upload function for collection preview images. An attacker may upload an HTML file that includes malicious JavaScript code which will be executed if a user visits the direct URL of the collection preview image (Stored Cross Site Scripting). It is also possible to upload SVG files that include nested XML entities. Those are parsed when a user visits the direct URL of the collection preview image, which may be utilized for a Denial of Service attack. This issue affects edu-sharing: <8.0.8-RC2, <8.1.4-RC0, <9.0.0-RC19.

References (3)

Core 3
Core References
Exploit, Third Party Advisory
https://packetstormsecurity.com/files/179199
Various Sources third-party-advisory
https://r.sec-consult.com/metaventis

Scores

CVSS v3 7.4
EPSS 0.0083
EPSS Percentile 52.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-434
Status published
Products (1)
metaVentis GmbH/edu-sharing <8.0.8-RC2, <8.1.4-RC0, <9.0.0-RC19
Published Jun 20, 2024
Tracked Since Feb 18, 2026