{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "Stored XSS vulnerability in the Media Objects component of ILIAS before 5.1.21 and 5.2.x before 5.2.9 allows an authenticated user to inject JavaScript to gain administrator privileges, related to the setParameter function in Services/MediaObjects/classes/class.ilMediaItem.php."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-10-17T20:00:00Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://lists.ilias.de/pipermail/ilias-admins/2017-October/000053.html"}, {"tags": ["x_refsource_MISC"], "url": "https://www.ilias.de/docu/goto_docu_pg_75377_35.html"}, {"tags": ["x_refsource_MISC"], "url": "http://openwall.com/lists/oss-security/2017/10/17/3"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/ILIAS-eLearning/ILIAS/commit/b2a4660afec1e87d41c83c8e381f549bc6dfc70f"}, {"tags": ["x_refsource_MISC"], "url": "https://www.ilias.de/docu/goto_docu_pg_75378_1719.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2017-15538", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Stored XSS vulnerability in the Media Objects component of ILIAS before 5.1.21 and 5.2.x before 5.2.9 allows an authenticated user to inject JavaScript to gain administrator privileges, related to the setParameter function in Services/MediaObjects/classes/class.ilMediaItem.php."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://lists.ilias.de/pipermail/ilias-admins/2017-October/000053.html", "refsource": "MISC", "url": "https://lists.ilias.de/pipermail/ilias-admins/2017-October/000053.html"}, {"name": "https://www.ilias.de/docu/goto_docu_pg_75377_35.html", "refsource": "MISC", "url": "https://www.ilias.de/docu/goto_docu_pg_75377_35.html"}, {"name": "http://openwall.com/lists/oss-security/2017/10/17/3", "refsource": "MISC", "url": "http://openwall.com/lists/oss-security/2017/10/17/3"}, {"name": "https://github.com/ILIAS-eLearning/ILIAS/commit/b2a4660afec1e87d41c83c8e381f549bc6dfc70f", "refsource": "MISC", "url": "https://github.com/ILIAS-eLearning/ILIAS/commit/b2a4660afec1e87d41c83c8e381f549bc6dfc70f"}, {"name": "https://www.ilias.de/docu/goto_docu_pg_75378_1719.html", "refsource": "MISC", "url": "https://www.ilias.de/docu/goto_docu_pg_75378_1719.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T19:57:26.464Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://lists.ilias.de/pipermail/ilias-admins/2017-October/000053.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.ilias.de/docu/goto_docu_pg_75377_35.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://openwall.com/lists/oss-security/2017/10/17/3"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/ILIAS-eLearning/ILIAS/commit/b2a4660afec1e87d41c83c8e381f549bc6dfc70f"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.ilias.de/docu/goto_docu_pg_75378_1719.html"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2017-15538", "datePublished": "2017-10-17T20:00:00Z", "dateReserved": "2017-10-17T00:00:00Z", "dateUpdated": "2024-09-17T00:10:44.832Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ilias:ilias:*:*:*:*:*:*:*:*", "matchCriteriaId": "2FCDD5A5-A108-4618-AB21-B6846FF59472", "versionEndIncluding": "5.1.21", "vulnerable": true}, {"criteria": "cpe:2.3:a:ilias:ilias:*:*:*:*:*:*:*:*", "matchCriteriaId": "516BEB53-5FE4-465E-992D-9033DC4664E9", "versionEndExcluding": "5.2.9", "versionStartIncluding": "5.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Stored XSS vulnerability in the Media Objects component of ILIAS before 5.1.21 and 5.2.x before 5.2.9 allows an authenticated user to inject JavaScript to gain administrator privileges, related to the setParameter function in Services/MediaObjects/classes/class.ilMediaItem.php."}, {"lang": "es", "value": "Vulnerabilidad Cross-Site Scripting (XSS) persistente en el componente Media Objects de ILIAS en versiones anteriores a 5.1.21 y 5.2.x anteriores a 5.2.9 permite que un usuario autenticado inyecte JavaScript para obtener privilegios de administrador, relacionado con la funci\u00f3n setParameter en Services/MediaObjects/classes/class.ilMediaItem.php."}], "id": "CVE-2017-15538", "lastModified": "2018-06-19T14:59:47.717", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-10-17T20:29:00.197", "references": [{"source": "cve@mitre.org", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "url": "http://openwall.com/lists/oss-security/2017/10/17/3"}, {"source": "cve@mitre.org", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://github.com/ILIAS-eLearning/ILIAS/commit/b2a4660afec1e87d41c83c8e381f549bc6dfc70f"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://lists.ilias.de/pipermail/ilias-admins/2017-October/000053.html"}, {"source": "cve@mitre.org", "tags": ["Issue Tracking", "Release Notes", "Vendor Advisory"], "url": "https://www.ilias.de/docu/goto_docu_pg_75377_35.html"}, {"source": "cve@mitre.org", "tags": ["Issue Tracking", "Release Notes", "Vendor Advisory"], "url": "https://www.ilias.de/docu/goto_docu_pg_75378_1719.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}