CVE-2024-30618: XSS

Published Nov 4, 2024

Updated

A Stored Cross-Site Scripting (XSS) Vulnerability in Chamilo LMS 1.11.26 allows a remote attacker to execute arbitrary JavaScript in a web browser by including a malicious payload in the 'content' parameter of 'grouptopics.php'.

Affected Software

2 affected components

Chamilo LMS

Chamilo Chamilo LMS=1.11.26

Remediation

Patch Available

https://github.com/chamilo/chamilo-lms/commit/3b98682199049ebfb170ace16ada9a7c8e9a6622

Event History

Nov 4, 2024

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·07:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-30618?

CVE-2024-30618 has a high severity rating due to its potential for remote code execution via stored XSS.

How do I fix CVE-2024-30618?

To fix CVE-2024-30618, upgrade Chamilo LMS to version 1.11.27 or apply an appropriate patch.

Can CVE-2024-30618 affect users directly?

Yes, CVE-2024-30618 can directly affect users by executing arbitrary JavaScript in their web browsers.

Who can exploit CVE-2024-30618?

A remote attacker can exploit CVE-2024-30618 by injecting a malicious payload into the 'content' parameter of 'group_topics.php'.

Is CVE-2024-30618 related to other vulnerabilities?

CVE-2024-30618 is specifically related to stored XSS vulnerabilities, a common threat in web applications.