Vulnerability CVE-2024-25974


Published: 2024-02-20

Description:
The Frentix GmbH OpenOlat LMS is affected by stored a Cross-Site Scripting (XSS) vulnerability. It is possible to upload files within the Media Center of OpenOlat version 18.1.5 (or lower) as an authenticated user without any other rights. Although the filetypes are limited, an SVG image containing an XSS payload can be uploaded. After a successful upload the file can be shared with groups of users (including admins) who can be attacked with the JavaScript payload.

See advisories in our WLB2 database:
Topic
Author
Date
Med.
OpenOLAT 18.1.5 Cross Site Scripting / Privilege Escalation
Johannes Volpel
22.02.2024

 References:
https://r.sec-consult.com/openolat

Copyright 2024, cxsecurity.com

 

Back to Top