Summary
Ein entfernter Angreifer kann mehrere Schwachstellen in ILIAS ausnutzen, um beliebigen Code auszuführen oder einen Cross-Site Scripting (XSS) Angriff durchzuführen.
Product
ILIAS ist eine Open Source e-Learning Lösung.
Vulnerabilities 5
-
High 7.2
ILIAS 7 before 7.30 and ILIAS 8 before 8.11 as well as ILIAS 9.0 allow remote authenticated attackers with administrati…
-
High 7.1
A Stored Cross-site Scripting (XSS) vulnerability in the "Import of user role and title of user role" feature in ILIAS …
-
Medium 5.4
A Stored Cross-site Scripting (XSS) vulnerability in the "Import of Users and login name of user" feature in ILIAS 7 be…
-
Medium 4.7
A Stored Cross-site Scripting (XSS) vulnerability in ILIAS 7 before 7.30 and ILIAS 8 before 8.11 allows remote authenti…
-
Medium 4.3
A Stored Cross-site Scripting (XSS) vulnerability in the "Import of organizational units and title of organizational un…
Revision history
-
#3
Advisory von ERNW mit PoC aufgenommen
-
#2
Weitere gefixte Schwachstellen und Produktversionen ergänzt
-
#1
Initiale Fassung
References
-
Ilias Release 9.1 vom 2024-05-17
https://docu.ilias.de/goto_docu_pg_170040_35.html
-
Ilias Release 8.1.1 vom 2024-05-14
https://docu.ilias.de/goto_docu_pg_170029_1719.html
-
Ilias Release 7.3.0 vom 2024-05-14
https://docu.ilias.de/goto_docu_pg_159938_1719.html
-
Security Advisory: Achieving PHP Code Execution in ILIAS eLearning LMS before v7.30/v8.11/v9.1 vom 2024-05-22
https://insinuator.net/2024/05/security-advisory-achieving-php-code-execution-in-ilias-elearning-lms-before-v7-30-v8-11-v9-1/