CVE-2017-15538

    Dashboard / Vulnerabilities / CVE-2017-15538

    CVE-2017-15538

    Published: 17 Oct 2017Last Modified: 8 Jul 2026

    Summary:

    Details: Stored XSS vulnerability in the Media Objects component of ILIAS before 5.1.21 and 5.2.x before 5.2.9 allows an authenticated user to inject JavaScript to gain administrator privileges, related to the setParameter function in Services/MediaObjects/classes/class.ilMediaItem.php.

    References: https://lists.ilias.de/pipermail/ilias-admins/2017-October/000053.html, https://www.ilias.de/docu/goto_docu_pg_75377_35.html, https://www.ilias.de/docu/goto_docu_pg_75378_1719.html, http://openwall.com/lists/oss-security/2017/10/17/3, https://github.com/ILIAS-eLearning/ILIAS/commit/b2a4660afec1e87d41c83c8e381f549bc6dfc70f

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    v5.1.21
    v5.1.0
    v5.1.18
    v5.1.17
    v5.1.14
    v5.1.13
    v5.1.10
    v5.1.9
    v5.1.8
    v5.1.6
    v5.1.5
    v5.1.2
    v5.1.1
    v5.1.0beta2

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High