CVE-2024-33525

{"id": "CVE-2024-33525", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 0.9}]}, "published": "2024-05-21T19:15:10.010", "references": [{"url": "https://docu.ilias.de/ilias.php?baseClass=illmpresentationgui&cmd=layout&ref_id=1719&obj_id=159938", "source": "cve@mitre.org"}, {"url": "https://docu.ilias.de/ilias.php?baseClass=illmpresentationgui&cmd=layout&ref_id=1719&obj_id=170029", "source": "cve@mitre.org"}, {"url": "https://docu.ilias.de/ilias.php?baseClass=illmpresentationgui&cmd=layout&ref_id=1719&obj_id=170040", "source": "cve@mitre.org"}, {"url": "https://insinuator.net/2024/05/security-advisory-achieving-php-code-execution-in-ilias-elearning-lms-before-v7-30-v8-11-v9-1/", "source": "cve@mitre.org"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A Stored Cross-site Scripting (XSS) vulnerability in the \"Import of organizational units and title of organizational unit\" feature in ILIAS 7.20 to 7.29 and ILIAS 8.4 to 8.10 as well as ILIAS 9.0 allows remote authenticated attackers with administrative privileges to inject arbitrary web script or HTML via XML file upload."}, {"lang": "es", "value": " Una vulnerabilidad de Cross Site Scripting Almacenado (XSS) en la funci\u00f3n \"Import of organizational units and title of organizational unit\" en ILIAS 7.20 a 7.30 e ILIAS 8.4 a 8.10, as\u00ed como ILIAS 9.0, permite a atacantes remotos autenticados con privilegios administrativos inyectar archivos web arbitrarios. script o HTML a trav\u00e9s de la carga de archivos XML."}], "lastModified": "2024-07-03T01:58:23.960", "sourceIdentifier": "cve@mitre.org"}