CVE-2017-15538 - Vulnerability Details - OpenCVE

Stored XSS vulnerability in the Media Objects component of ILIAS before 5.1.21 and 5.2.x before 5.2.9 allows an authenticated user to inject JavaScript to gain administrator privileges, related to the setParameter function in Services/MediaObjects/classes/class.ilMediaItem.php.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00433.

Key SSVC decision points have not yet been added.

Vendors	Products
Ilias	Ilias

Configuration 1 [-]

OR	cpe:2.3:a:ilias:ilias::::::::
	cpe:2.3:a:ilias:ilias::::::::

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2017-6990	Stored XSS vulnerability in the Media Objects component of ILIAS before 5.1.21 and 5.2.x before 5.2.9 allows an authenticated user to inject JavaScript to gain administrator privileges, related to the setParameter function in Services/MediaObjects/classes/class.ilMediaItem.php.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://openwall.com/lists/oss-security/2017/10/17/3
https://github.com/ILIAS-eLearning/ILIAS/commit/b2a4660afec1e87d41c83c8e381f549bc6dfc70f
https://lists.ilias.de/pipermail/ilias-admins/2017-October/000053.html
https://www.ilias.de/docu/goto_docu_pg_75377_35.html
https://www.ilias.de/docu/goto_docu_pg_75378_1719.html

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2017-10-17T20:00:00Z

Updated: 2024-09-17T00:10:44.832Z

Reserved: 2017-10-17T00:00:00Z

Link: CVE-2017-15538

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2017-10-17T20:29:00.197

Modified: 2025-04-20T01:37:25.860

Link: CVE-2017-15538

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "Stored XSS vulnerability in the Media Objects component of ILIAS before 5.1.21 and 5.2.x before 5.2.9 allows an authenticated user to inject JavaScript to gain administrator privileges, related to the setParameter function in Services/MediaObjects/classes/class.ilMediaItem.php."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-10-17T20:00:00Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://lists.ilias.de/pipermail/ilias-admins/2017-October/000053.html"}, {"tags": ["x_refsource_MISC"], "url": "https://www.ilias.de/docu/goto_docu_pg_75377_35.html"}, {"tags": ["x_refsource_MISC"], "url": "http://openwall.com/lists/oss-security/2017/10/17/3"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/ILIAS-eLearning/ILIAS/commit/b2a4660afec1e87d41c83c8e381f549bc6dfc70f"}, {"tags": ["x_refsource_MISC"], "url": "https://www.ilias.de/docu/goto_docu_pg_75378_1719.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2017-15538", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Stored XSS vulnerability in the Media Objects component of ILIAS before 5.1.21 and 5.2.x before 5.2.9 allows an authenticated user to inject JavaScript to gain administrator privileges, related to the setParameter function in Services/MediaObjects/classes/class.ilMediaItem.php."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://lists.ilias.de/pipermail/ilias-admins/2017-October/000053.html", "refsource": "MISC", "url": "https://lists.ilias.de/pipermail/ilias-admins/2017-October/000053.html"}, {"name": "https://www.ilias.de/docu/goto_docu_pg_75377_35.html", "refsource": "MISC", "url": "https://www.ilias.de/docu/goto_docu_pg_75377_35.html"}, {"name": "http://openwall.com/lists/oss-security/2017/10/17/3", "refsource": "MISC", "url": "http://openwall.com/lists/oss-security/2017/10/17/3"}, {"name": "https://github.com/ILIAS-eLearning/ILIAS/commit/b2a4660afec1e87d41c83c8e381f549bc6dfc70f", "refsource": "MISC", "url": "https://github.com/ILIAS-eLearning/ILIAS/commit/b2a4660afec1e87d41c83c8e381f549bc6dfc70f"}, {"name": "https://www.ilias.de/docu/goto_docu_pg_75378_1719.html", "refsource": "MISC", "url": "https://www.ilias.de/docu/goto_docu_pg_75378_1719.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T19:57:26.464Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://lists.ilias.de/pipermail/ilias-admins/2017-October/000053.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.ilias.de/docu/goto_docu_pg_75377_35.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://openwall.com/lists/oss-security/2017/10/17/3"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/ILIAS-eLearning/ILIAS/commit/b2a4660afec1e87d41c83c8e381f549bc6dfc70f"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.ilias.de/docu/goto_docu_pg_75378_1719.html"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2017-15538", "datePublished": "2017-10-17T20:00:00Z", "dateReserved": "2017-10-17T00:00:00Z", "dateUpdated": "2024-09-17T00:10:44.832Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ilias:ilias:*:*:*:*:*:*:*:*", "matchCriteriaId": "2FCDD5A5-A108-4618-AB21-B6846FF59472", "versionEndIncluding": "5.1.21", "vulnerable": true}, {"criteria": "cpe:2.3:a:ilias:ilias:*:*:*:*:*:*:*:*", "matchCriteriaId": "516BEB53-5FE4-465E-992D-9033DC4664E9", "versionEndExcluding": "5.2.9", "versionStartIncluding": "5.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Stored XSS vulnerability in the Media Objects component of ILIAS before 5.1.21 and 5.2.x before 5.2.9 allows an authenticated user to inject JavaScript to gain administrator privileges, related to the setParameter function in Services/MediaObjects/classes/class.ilMediaItem.php."}, {"lang": "es", "value": "Vulnerabilidad Cross-Site Scripting (XSS) persistente en el componente Media Objects de ILIAS en versiones anteriores a 5.1.21 y 5.2.x anteriores a 5.2.9 permite que un usuario autenticado inyecte JavaScript para obtener privilegios de administrador, relacionado con la funci\u00f3n setParameter en Services/MediaObjects/classes/class.ilMediaItem.php."}], "id": "CVE-2017-15538", "lastModified": "2025-04-20T01:37:25.860", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-10-17T20:29:00.197", "references": [{"source": "cve@mitre.org", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "url": "http://openwall.com/lists/oss-security/2017/10/17/3"}, {"source": "cve@mitre.org", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://github.com/ILIAS-eLearning/ILIAS/commit/b2a4660afec1e87d41c83c8e381f549bc6dfc70f"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://lists.ilias.de/pipermail/ilias-admins/2017-October/000053.html"}, {"source": "cve@mitre.org", "tags": ["Issue Tracking", "Release Notes", "Vendor Advisory"], "url": "https://www.ilias.de/docu/goto_docu_pg_75377_35.html"}, {"source": "cve@mitre.org", "tags": ["Issue Tracking", "Release Notes", "Vendor Advisory"], "url": "https://www.ilias.de/docu/goto_docu_pg_75378_1719.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "url": "http://openwall.com/lists/oss-security/2017/10/17/3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://github.com/ILIAS-eLearning/ILIAS/commit/b2a4660afec1e87d41c83c8e381f549bc6dfc70f"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://lists.ilias.de/pipermail/ilias-admins/2017-October/000053.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Release Notes", "Vendor Advisory"], "url": "https://www.ilias.de/docu/goto_docu_pg_75377_35.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Release Notes", "Vendor Advisory"], "url": "https://www.ilias.de/docu/goto_docu_pg_75378_1719.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}