CVE-2023-4119: Academy LMS courses cross site scripting
A vulnerability has been found in Academy LMS 6.0 and classified as problematic. This vulnerability affects unknown code of the file /academy/home/courses. The manipulation of the argument query/sortby leads to cross site scripting. The attack can be initiated remotely. VDB-235966 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Credit
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-4119?
The severity of CVE-2023-4119 is medium with a severity value of 6.1.
What is the affected software version of CVE-2023-4119?
CVE-2023-4119 affects Creativeitem Academy LMS version 6.0.
What is the CWE category of CVE-2023-4119?
CVE-2023-4119 falls under CWE category 79: Cross-Site Scripting (XSS).
How can I exploit CVE-2023-4119?
Exploiting CVE-2023-4119 requires manipulating the 'query/sort_by' argument in the code of the /academy/home/courses file to execute cross-site scripting attacks remotely.
How can I fix CVE-2023-4119?
To fix CVE-2023-4119, update Creativeitem Academy LMS to a version that addresses the cross-site scripting vulnerability.