CVE-2024-25974CWE-20

Stored Cross-Site Scripting (XSS) within the Media Center

Medium · published February 20, 2024

CVSS v3.1
5.4
EPSS
1%
Percentile
45.3
In the wild
Unconfirmed
What it is

The Frentix GmbH OpenOlat LMS is affected by stored a Cross-Site Scripting (XSS) vulnerability. It is possible to upload files within the Media Center of OpenOlat version 18.1.5 (or lower) as an authenticated user without any other rights. Although the filetypes are limited, an SVG image containing an XSS payload can be uploaded. After a successful upload the file can be shared with groups of users (including admins) who can be attacked with the JavaScript payload.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00550 · 45.3th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2024-02-20T08:02Z
EPSS history
Timeline
  • 20 FEB 08:02Z
    Stored Cross-Site Scripting (XSS) within the Media Center
    cvelistv5