Description
A vulnerability was found in Ellucian Ethos Identity up to 5.10.5. It has been classified as problematic. Affected is an unknown function of the file /cas/logout. The manipulation of the argument url leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 5.10.6 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-229596.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Ellucian | Ethos Identity | 5.10.0, 5.10.1, 5.10.2, 5.10.3, 5.10.4, 5.10.5 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
cberman/CVE-2023-2822-demo ★ 3 · May 22, 2023
Simple flask application to implement an intentionally vulnerable web app to demo CVE-2023-2822.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Ellucian Ethos Identity CAS - Cross-Site Scripting http/cves/2023/CVE-2023-2822.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- https://vuldb.com/?id.229596 vdb-entry technical-description
- https://vuldb.com/?ctiid.229596 signature permissions-required
- https://medium.com/@cyberninja717/reflected-cross-site-scripting-vulnerability-in-ellucian-ethos-identity-cas-logout-page-685bb1675dfb related
- https://medium.com/@cyberninja717/685bb1675dfb exploit