CVSS 3.0
5.4 mediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NCVE-2017-15538
Stored XSS vulnerability in the Media Objects component of ILIAS before 5.1.21 and 5.2.x before 5.2.9 allows an authenticated user to inject JavaScript to gain administrator privileges, related to the setParameter function in Services/MediaObjects/classes/class.ilMediaItem.php.
Severity
- EPSS
- 0.9% chance of exploitation in the next 30 days; higher than 61% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- ilias:ilias
References
- http://openwall.com/lists/oss-security/2017/10/17/3
- https://github.com/ILIAS-eLearning/ILIAS/commit/b2a4660afec1e87d41c83c8e381f549bc6dfc70f
- https://lists.ilias.de/pipermail/ilias-admins/2017-October/000053.html
- https://www.ilias.de/docu/goto_docu_pg_75377_35.html
- https://www.ilias.de/docu/goto_docu_pg_75378_1719.html