Vulnerability · Published Jun 20, 2024 · Assigned by SEC-VLab

CVE-2024-28147Unrestricted Upload of Files in edu-sharing

High 7.4

In plain English

A high-severity unrestricted file upload in edu-sharing from metaVentis GmbH. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).

Severity (CVSS 3.1)7.4High

Exploit odds (30 days)0.8%top 42.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

An authenticated user can upload arbitrary files in the upload function for collection preview images. An attacker may upload an HTML file that includes malicious JavaScript code which will be executed if a user visits the direct URL of the collection preview image (Stored Cross Site Scripting). It is also possible to upload SVG files that include nested XML entities. Those are parsed when a user visits the direct URL of the collection preview image, which may be utilized for a Denial of Service attack. This issue affects edu-sharing: <8.0.8-RC2, <8.1.4-RC0, <9.0.0-RC19.

Affected products (as reported)

Vendor	Product	Versions
metaVentis GmbH	edu-sharing	<8.0.8-RC2, <8.1.4-RC0, <9.0.0-RC19

Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H

References

https://r.sec-consult.com/metaventis third-party-advisory
http://seclists.org/fulldisclosure/2024/Jun/11
https://packetstormsecurity.com/files/179199 third-party-advisory, exploit, technical-description