Cross site scripting

2022-08-2517:15:00

PRIOn knowledge base

www.prio-n.com

vulnerable

cross site scripting

javascript execution

calendar event

5.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

24.2%

JSON

Claroline 13.5.7 and prior is vulnerable to Cross Site Scripting (XSS). An attacker can obtain javascript code execution by adding arbitrary javascript code in the ‘Location’ field of a calendar event.

CPENameOperatorVersion
clarolinele13.5.7

CPE	Name	Operator	Version
	claroline	le	13.5.7

References

github.com/matthieu-hackwitharts/claroline-CVEs/blob/main/calendar_xss/calendar_xss.md