CVE-2024-25974

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Frentix GmbH OpenOlat LMS is affected by stored a Cross-Site Scripting (XSS) vulnerability. It is possible to upload files within the Media Center of OpenOlat version 18.1.5 (or lower) as an authenticated user without any other rights. Although the filetypes are limited, an SVG image containing an XSS payload can be uploaded. After a successful upload the file can be shared with groups of users (including admins) who can be attacked with the JavaScript payload.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-20 CWE-79

Affected software

Vendor	Product	Versions
Frentix GmbH	OpenOlat LMS	<= 18.1.5
frentix	openolat	<= 18.1.5

References

http://seclists.org/fulldisclosure/2024/Feb/23Exploit, Mailing List, Third Party Advisory
https://r.sec-consult.com/openolatExploit, Third Party Advisory
http://seclists.org/fulldisclosure/2024/Feb/23Exploit, Mailing List, Third Party Advisory
https://r.sec-consult.com/openolatExploit, Third Party Advisory

Timeline

Published: Feb 20, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-259756.5The application implements an up- and downvote function which alters a value within a JSON file. The POST parameters are not filtered proper CVE-2024-259766.1When LDAP authentication is activated in the configuration it is possible to obtain reflected XSS execution by creating a custom URL that th CVE-2024-259777.3The application does not change the session token when using the login or logout functionality. An attacker can set a session token in the v CVE-2024-259787.5Insufficient file size checks resulted in a denial of service risk in the file picker's unzip functionality.CVE-2024-259795.3The URL parameters accepted by forum search were not limited to the allowed parameters.CVE-2024-25986.1Vulnerability in AMSS++ version 4.31, which does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting (XSS) vu CVE-2024-259805.3Separate Groups mode restrictions were not honored in the H5P attempts report, which would display users from other groups. By default this CVE-2024-259815.3Separate Groups mode restrictions were not honored when performing a forum export, which would export forum data for all groups. By default CVE-2024-259828.8The link to update all installed language packs did not include the necessary token to prevent a CSRF risk.CVE-2024-259835.3Insufficient checks in a web service made it possible to add comments to the comments block on another user's dashboard when it was not othe CVE-2024-259846.2In dumpBatteryDefend of dump_power.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local infor CVE-2024-259858.4In bigo_unlocked_ioctl of bigo.c, there is a possible UAF due to a missing bounds check. This could lead to local escalation of privilege wi