CVE-2023-45869: XSS

Published Oct 26, 2023

Updated

ILIAS 7.25 (2023-09-12) allows any authenticated user to execute arbitrary operating system commands remotely, when a highly privileged account accesses an XSS payload. The injected commands are executed via the exec() function in the execQuoted() method of the ilUtil class (/Services/Utilities/classes/class.ilUtil.php) This allows attackers to inject malicious commands into the system, potentially compromising the integrity, confidentiality, and availability of the ILIAS installation and the underlying operating system.

Affected Software

1 affected component

ILIAS ILIAS=7.25

Event History

Oct 26, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionSeverity

Data Sourced

via NVD·03:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2023-45869?

CVE-2023-45869 is a vulnerability found in ILIAS 7.25 that allows any authenticated user to execute arbitrary operating system commands remotely.

How severe is CVE-2023-45869?

CVE-2023-45869 has a severity level of critical with a severity value of 9.

Which software versions are affected by CVE-2023-45869?

ILIAS 7.25 is the affected software version for CVE-2023-45869.

How can an attacker exploit CVE-2023-45869?

An attacker can exploit CVE-2023-45869 by injecting malicious XSS payloads and having a highly privileged account access it, leading to the execution of arbitrary operating system commands.

Is there a fix available for CVE-2023-45869?

At the moment, there is no known fix available for CVE-2023-45869. It is recommended to follow the provided references for updates and mitigation strategies.