CVE-2017-15538 - Vulnerability Details - OpenCVE

Stored XSS vulnerability in the Media Objects component of ILIAS before 5.1.21 and 5.2.x before 5.2.9 allows an authenticated user to inject JavaScript to gain administrator privileges, related to the setParameter function in Services/MediaObjects/classes/class.ilMediaItem.php.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00433.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

n/a

affected

Version	Status	Constraints
`n/a`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:ilias:ilias::::::::
	cpe:2.3:a:ilias:ilias::::::::

No data.

No data.

Project Subscriptions

Vendors	Products
Ilias Subscribe	Ilias Subscribe

Advisories

Source	ID	Title
EUVD	EUVD-2017-6990	Stored XSS vulnerability in the Media Objects component of ILIAS before 5.1.21 and 5.2.x before 5.2.9 allows an authenticated user to inject JavaScript to gain administrator privileges, related to the setParameter function in Services/MediaObjects/classes/class.ilMediaItem.php.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://openwall.com/lists/oss-security/2017/10/17/3
https://github.com/ILIAS-eLearning/ILIAS/commit/b2a4660afec1e87d41c83c8e381f549bc6dfc70f
https://lists.ilias.de/pipermail/ilias-admins/2017-October/000053.html
https://www.ilias.de/docu/goto_docu_pg_75377_35.html
https://www.ilias.de/docu/goto_docu_pg_75378_1719.html

History

No history.

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2017-10-17T20:00:00.000Z

Updated: 2024-09-17T00:10:44.832Z

Reserved: 2017-10-17T00:00:00.000Z

Link: CVE-2017-15538

Vulnrichment

No data.

NVD

Status : Modified

Published: 2017-10-17T20:29:00.197

Modified: 2026-05-13T00:24:29.033

Link: CVE-2017-15538

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-79

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "Stored XSS vulnerability in the Media Objects component of ILIAS before 5.1.21 and 5.2.x before 5.2.9 allows an authenticated user to inject JavaScript to gain administrator privileges, related to the setParameter function in Services/MediaObjects/classes/class.ilMediaItem.php."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-10-17T20:00:00.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://lists.ilias.de/pipermail/ilias-admins/2017-October/000053.html"}, {"tags": ["x_refsource_MISC"], "url": "https://www.ilias.de/docu/goto_docu_pg_75377_35.html"}, {"tags": ["x_refsource_MISC"], "url": "http://openwall.com/lists/oss-security/2017/10/17/3"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/ILIAS-eLearning/ILIAS/commit/b2a4660afec1e87d41c83c8e381f549bc6dfc70f"}, {"tags": ["x_refsource_MISC"], "url": "https://www.ilias.de/docu/goto_docu_pg_75378_1719.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2017-15538", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Stored XSS vulnerability in the Media Objects component of ILIAS before 5.1.21 and 5.2.x before 5.2.9 allows an authenticated user to inject JavaScript to gain administrator privileges, related to the setParameter function in Services/MediaObjects/classes/class.ilMediaItem.php."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://lists.ilias.de/pipermail/ilias-admins/2017-October/000053.html", "refsource": "MISC", "url": "https://lists.ilias.de/pipermail/ilias-admins/2017-October/000053.html"}, {"name": "https://www.ilias.de/docu/goto_docu_pg_75377_35.html", "refsource": "MISC", "url": "https://www.ilias.de/docu/goto_docu_pg_75377_35.html"}, {"name": "http://openwall.com/lists/oss-security/2017/10/17/3", "refsource": "MISC", "url": "http://openwall.com/lists/oss-security/2017/10/17/3"}, {"name": "https://github.com/ILIAS-eLearning/ILIAS/commit/b2a4660afec1e87d41c83c8e381f549bc6dfc70f", "refsource": "MISC", "url": "https://github.com/ILIAS-eLearning/ILIAS/commit/b2a4660afec1e87d41c83c8e381f549bc6dfc70f"}, {"name": "https://www.ilias.de/docu/goto_docu_pg_75378_1719.html", "refsource": "MISC", "url": "https://www.ilias.de/docu/goto_docu_pg_75378_1719.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T19:57:26.464Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://lists.ilias.de/pipermail/ilias-admins/2017-October/000053.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.ilias.de/docu/goto_docu_pg_75377_35.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://openwall.com/lists/oss-security/2017/10/17/3"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/ILIAS-eLearning/ILIAS/commit/b2a4660afec1e87d41c83c8e381f549bc6dfc70f"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.ilias.de/docu/goto_docu_pg_75378_1719.html"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2017-15538", "datePublished": "2017-10-17T20:00:00.000Z", "dateReserved": "2017-10-17T00:00:00.000Z", "dateUpdated": "2024-09-17T00:10:44.832Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ilias:ilias:*:*:*:*:*:*:*:*", "matchCriteriaId": "2FCDD5A5-A108-4618-AB21-B6846FF59472", "versionEndIncluding": "5.1.21", "vulnerable": true}, {"criteria": "cpe:2.3:a:ilias:ilias:*:*:*:*:*:*:*:*", "matchCriteriaId": "516BEB53-5FE4-465E-992D-9033DC4664E9", "versionEndExcluding": "5.2.9", "versionStartIncluding": "5.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Stored XSS vulnerability in the Media Objects component of ILIAS before 5.1.21 and 5.2.x before 5.2.9 allows an authenticated user to inject JavaScript to gain administrator privileges, related to the setParameter function in Services/MediaObjects/classes/class.ilMediaItem.php."}, {"lang": "es", "value": "Vulnerabilidad Cross-Site Scripting (XSS) persistente en el componente Media Objects de ILIAS en versiones anteriores a 5.1.21 y 5.2.x anteriores a 5.2.9 permite que un usuario autenticado inyecte JavaScript para obtener privilegios de administrador, relacionado con la funci\u00f3n setParameter en Services/MediaObjects/classes/class.ilMediaItem.php."}], "id": "CVE-2017-15538", "lastModified": "2026-05-13T00:24:29.033", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-10-17T20:29:00.197", "references": [{"source": "cve@mitre.org", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "url": "http://openwall.com/lists/oss-security/2017/10/17/3"}, {"source": "cve@mitre.org", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://github.com/ILIAS-eLearning/ILIAS/commit/b2a4660afec1e87d41c83c8e381f549bc6dfc70f"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://lists.ilias.de/pipermail/ilias-admins/2017-October/000053.html"}, {"source": "cve@mitre.org", "tags": ["Issue Tracking", "Release Notes", "Vendor Advisory"], "url": "https://www.ilias.de/docu/goto_docu_pg_75377_35.html"}, {"source": "cve@mitre.org", "tags": ["Issue Tracking", "Release Notes", "Vendor Advisory"], "url": "https://www.ilias.de/docu/goto_docu_pg_75378_1719.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "url": "http://openwall.com/lists/oss-security/2017/10/17/3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://github.com/ILIAS-eLearning/ILIAS/commit/b2a4660afec1e87d41c83c8e381f549bc6dfc70f"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://lists.ilias.de/pipermail/ilias-admins/2017-October/000053.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Release Notes", "Vendor Advisory"], "url": "https://www.ilias.de/docu/goto_docu_pg_75377_35.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Release Notes", "Vendor Advisory"], "url": "https://www.ilias.de/docu/goto_docu_pg_75378_1719.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}