Vulnerability-Lookup

CNVD-2017-32858

Vulnerability from cnvd - Published: 2017-11-06

Title

ILIAS Media Objects组件跨站脚本漏洞

Description

ILIAS是ILIAS团队开发的一套基于Web的学习管理系统。该系统包含课程管理、文件共享、即时对话等模块。Media Objects component是其中的一个媒体对象组件。 ILIAS 5.1.21之前的版本和5.2.9之前的5.2.x版本中的Media Objects组件存在跨站脚本漏洞。远程攻击者可利用该漏洞注入JavaScript代码，获取管理员权限。

Severity

中

Patch Name

ILIAS Media Objects组件跨站脚本漏洞的补丁

Patch Description

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://www.ilias.de/docu/goto_docu_pg_75377_35.html

Reference

http://openwall.com/lists/oss-security/2017/10/17/3

Impacted products

Name
['Ilias Ilias <5.1.21', 'Ilias Ilias <5.2.9，5.2.x']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-15538"
    }
  },
  "description": "ILIAS\u662fILIAS\u56e2\u961f\u5f00\u53d1\u7684\u4e00\u5957\u57fa\u4e8eWeb\u7684\u5b66\u4e60\u7ba1\u7406\u7cfb\u7edf\u3002\u8be5\u7cfb\u7edf\u5305\u542b\u8bfe\u7a0b\u7ba1\u7406\u3001\u6587\u4ef6\u5171\u4eab\u3001\u5373\u65f6\u5bf9\u8bdd\u7b49\u6a21\u5757\u3002Media Objects component\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u5a92\u4f53\u5bf9\u8c61\u7ec4\u4ef6\u3002\r\n\r\nILIAS 5.1.21\u4e4b\u524d\u7684\u7248\u672c\u548c5.2.9\u4e4b\u524d\u76845.2.x\u7248\u672c\u4e2d\u7684Media Objects\u7ec4\u4ef6\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6ce8\u5165JavaScript\u4ee3\u7801\uff0c\u83b7\u53d6\u7ba1\u7406\u5458\u6743\u9650\u3002",
  "discovererName": "Unknow",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://www.ilias.de/docu/goto_docu_pg_75377_35.html",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-32858",
  "openTime": "2017-11-06",
  "patchDescription": "ILIAS\u662fILIAS\u56e2\u961f\u5f00\u53d1\u7684\u4e00\u5957\u57fa\u4e8eWeb\u7684\u5b66\u4e60\u7ba1\u7406\u7cfb\u7edf\u3002\u8be5\u7cfb\u7edf\u5305\u542b\u8bfe\u7a0b\u7ba1\u7406\u3001\u6587\u4ef6\u5171\u4eab\u3001\u5373\u65f6\u5bf9\u8bdd\u7b49\u6a21\u5757\u3002Media Objects component\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u5a92\u4f53\u5bf9\u8c61\u7ec4\u4ef6\u3002\r\n\r\nILIAS 5.1.21\u4e4b\u524d\u7684\u7248\u672c\u548c5.2.9\u4e4b\u524d\u76845.2.x\u7248\u672c\u4e2d\u7684Media Objects\u7ec4\u4ef6\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6ce8\u5165JavaScript\u4ee3\u7801\uff0c\u83b7\u53d6\u7ba1\u7406\u5458\u6743\u9650\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "ILIAS Media Objects\u7ec4\u4ef6\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Ilias Ilias \u003c5.1.21",
      "Ilias Ilias \u003c5.2.9\uff0c5.2.x"
    ]
  },
  "referenceLink": "http://openwall.com/lists/oss-security/2017/10/17/3",
  "serverity": "\u4e2d",
  "submitTime": "2017-10-30",
  "title": "ILIAS Media Objects\u7ec4\u4ef6\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e"
}

CVE-2017-15538 (GCVE-0-2017-15538)

Vulnerability from cvelistv5 – Published: 2017-10-17 20:00 – Updated: 2024-09-17 00:10

Summary

Stored XSS vulnerability in the Media Objects component of ILIAS before 5.1.21 and 5.2.x before 5.2.9 allows an authenticated user to inject JavaScript to gain administrator privileges, related to the setParameter function in Services/MediaObjects/classes/class.ilMediaItem.php.

Severity

No CVSS data available.

CWE

Assigner

mitre

References

5 references

URL	Tags
https://lists.ilias.de/pipermail/ilias-admins/201…	x_refsource_MISC
https://www.ilias.de/docu/goto_docu_pg_75377_35.html	x_refsource_MISC
http://openwall.com/lists/oss-security/2017/10/17/3	x_refsource_MISC
https://github.com/ILIAS-eLearning/ILIAS/commit/b…	x_refsource_MISC
https://www.ilias.de/docu/goto_docu_pg_75378_1719.html	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T19:57:26.464Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://lists.ilias.de/pipermail/ilias-admins/2017-October/000053.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.ilias.de/docu/goto_docu_pg_75377_35.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://openwall.com/lists/oss-security/2017/10/17/3"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/ILIAS-eLearning/ILIAS/commit/b2a4660afec1e87d41c83c8e381f549bc6dfc70f"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.ilias.de/docu/goto_docu_pg_75378_1719.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Stored XSS vulnerability in the Media Objects component of ILIAS before 5.1.21 and 5.2.x before 5.2.9 allows an authenticated user to inject JavaScript to gain administrator privileges, related to the setParameter function in Services/MediaObjects/classes/class.ilMediaItem.php."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-10-17T20:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lists.ilias.de/pipermail/ilias-admins/2017-October/000053.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.ilias.de/docu/goto_docu_pg_75377_35.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://openwall.com/lists/oss-security/2017/10/17/3"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ILIAS-eLearning/ILIAS/commit/b2a4660afec1e87d41c83c8e381f549bc6dfc70f"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.ilias.de/docu/goto_docu_pg_75378_1719.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-15538",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Stored XSS vulnerability in the Media Objects component of ILIAS before 5.1.21 and 5.2.x before 5.2.9 allows an authenticated user to inject JavaScript to gain administrator privileges, related to the setParameter function in Services/MediaObjects/classes/class.ilMediaItem.php."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://lists.ilias.de/pipermail/ilias-admins/2017-October/000053.html",
              "refsource": "MISC",
              "url": "https://lists.ilias.de/pipermail/ilias-admins/2017-October/000053.html"
            },
            {
              "name": "https://www.ilias.de/docu/goto_docu_pg_75377_35.html",
              "refsource": "MISC",
              "url": "https://www.ilias.de/docu/goto_docu_pg_75377_35.html"
            },
            {
              "name": "http://openwall.com/lists/oss-security/2017/10/17/3",
              "refsource": "MISC",
              "url": "http://openwall.com/lists/oss-security/2017/10/17/3"
            },
            {
              "name": "https://github.com/ILIAS-eLearning/ILIAS/commit/b2a4660afec1e87d41c83c8e381f549bc6dfc70f",
              "refsource": "MISC",
              "url": "https://github.com/ILIAS-eLearning/ILIAS/commit/b2a4660afec1e87d41c83c8e381f549bc6dfc70f"
            },
            {
              "name": "https://www.ilias.de/docu/goto_docu_pg_75378_1719.html",
              "refsource": "MISC",
              "url": "https://www.ilias.de/docu/goto_docu_pg_75378_1719.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-15538",
    "datePublished": "2017-10-17T20:00:00.000Z",
    "dateReserved": "2017-10-17T00:00:00.000Z",
    "dateUpdated": "2024-09-17T00:10:44.832Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CNVD-2017-32858

CVE-2017-15538 (GCVE-0-2017-15538)

Tags

Sightings

Nomenclature