[<prev] [next>] [day] [month] [year] [list]
Message-ID: <ec9146bf-2667-749a-8250-6dd28b319c8b@web.de>
Date: Sat, 23 Jul 2016 16:36:58 +0200
From: Walter <dpankraz1@....de>
To: oss-security@...ts.openwall.com
Subject: XSS vulnerability in ILIAS before version 5.1.3, 5.0.11 and 4.4.14
A cross-site scripting vulnerability in ILIAS <http://www.ilias.de>
(Integrated Learning, Information and Work Cooperation System) version
5.1.2 has been found by Quadas.
Impact:
This remotely accessible vulnerability is always reproducible and
possibly works in any version before 5.1.3, 5.0.11 and 4.4.14.
An attacker can supply java script code in the filename of an
uploaded file, which will be executed in browsers of other users. It
is not
required to open this file. Browsing into the folder will trigger
the code execution.
Exploit:
* log in
* open a folder you can upload a file to
* select the "upload files"-dialog
* drop a random file in
* write code (e.g. JavaScript) in the filename
* upload file
From this moment the code will run on any user's web browser who
opens the folder you uploaded the file in.
Patch:
Vulnerability was fixed with version 5.1.3, 5.0.11 and 4.4.14.
Ticket-ID was 0017977 but unfortunately the ticket was set on
private view status. Link to the ticket
<http://www.ilias.de/mantis/view.php?id=17977> (account is required)
Surprisingly there are no commits on GitHub
<https://github.com/ILIAS-eLearning/ILIAS>.
Can a CVE-ID be assigned please?
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
