Vulnerability · Published May 20, 2023 · Assigned by VulDB
CVE-2023-2822Ellucian Ethos Identity logout cross site scripting
Medium 4.3
In plain English
A medium-severity cross-site scripting in Ethos Identity from Ellucian. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 3.3% (higher than 89% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.
Official description
A vulnerability was found in Ellucian Ethos Identity up to 5.10.5. It has been classified as problematic. Affected is an unknown function of the file /cas/logout. The manipulation of the argument url leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 5.10.6 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-229596.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Ellucian | Ethos Identity | 5.10.05.10.15.10.25.10.35.10.45.10.5 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References
- https://vuldb.com/?id.229596 vdb-entry, technical-description
- https://vuldb.com/?ctiid.229596 signature, permissions-required
- https://medium.com/@cyberninja717/reflected-cross-site-scripting-vulnerability-in-ellucian-ethos-identity-cas-logout-page-685bb1675dfb related
- https://medium.com/@cyberninja717/685bb1675dfb exploit