CVE-2024-25974

The Frentix GmbH OpenOlat LMS is affected by stored a Cross-Site Scripting (XSS) vulnerability. It is possible to upload files within the Media Center of OpenOlat version 18.1.5 (or lower) as an authenticated user without any other rights. Although the filetypes are limited, an SVG image containing an XSS payload can be uploaded. After a successful upload the file can be shared with groups of users (including admins) who can be attacked with the JavaScript payload.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
http://seclists.org/fulldisclosure/2024/Feb/23	Exploit Mailing List Third Party Advisory
https://r.sec-consult.com/openolat	Exploit Third Party Advisory
http://seclists.org/fulldisclosure/2024/Feb/23	Exploit Mailing List Third Party Advisory
https://r.sec-consult.com/openolat	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:frentix:openolat:*:*:*:*:*:*:*:*

History

02 Apr 2025, 20:10

Type	Values Removed	Values Added
First Time		Frentix openolat Frentix
CPE		cpe:2.3:a:frentix:openolat::::::::
References	~~() http://seclists.org/fulldisclosure/2024/Feb/23 -~~	() http://seclists.org/fulldisclosure/2024/Feb/23 - Exploit, Mailing List, Third Party Advisory
References	~~() https://r.sec-consult.com/openolat -~~	() https://r.sec-consult.com/openolat - Exploit, Third Party Advisory
CWE		CWE-79

Information

Published : 2024-02-20 08:15

Updated : 2025-04-02 20:10

NVD link : CVE-2024-25974

Mitre link : CVE-2024-25974

CVE.ORG link : CVE-2024-25974

JSON object : View

Products Affected

frentix

openolat

CWE

CWE-20

Improper Input Validation

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2024-25974", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2024-02-20T08:15:07.823", "references": [{"url": "http://seclists.org/fulldisclosure/2024/Feb/23", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"}, {"url": "https://r.sec-consult.com/openolat", "tags": ["Exploit", "Third Party Advisory"], "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"}, {"url": "http://seclists.org/fulldisclosure/2024/Feb/23", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://r.sec-consult.com/openolat", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "description": [{"lang": "en", "value": "CWE-20"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "The Frentix GmbH OpenOlat LMS is affected by stored a Cross-Site Scripting (XSS) vulnerability.\u00a0It is possible to upload files within the Media Center of OpenOlat version 18.1.5 (or lower) as an authenticated user without any other rights. Although the filetypes are limited, an SVG image containing an XSS payload can be uploaded.\u00a0After a successful upload the file can be shared with groups of users (including admins) who can be attacked with the JavaScript payload."}, {"lang": "es", "value": "El LMS OpenOlat de Frentix GmbH se ve afectado por una vulnerabilidad de Cross-Site Scripting (XSS) Almacenado. Es posible cargar archivos dentro del Media Center de OpenOlat versi\u00f3n 18.1.5 (o inferior) como usuario autenticado sin ning\u00fan otro derecho. Aunque los tipos de archivos son limitados, se puede cargar una imagen SVG que contenga un payload XSS. Despu\u00e9s de una carga exitosa, el archivo se puede compartir con grupos de usuarios (incluidos administradores) que pueden ser atacados con el payload de JavaScript."}], "lastModified": "2025-04-02T20:10:53.337", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:frentix:openolat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C7A58DE8-BC68-48E5-B2B6-4B2196FE1FA7", "versionEndExcluding": "18.1.6"}], "operator": "OR"}]}], "sourceIdentifier": "551230f0-3615-47bd-b7cc-93e92e730bbf"}