CVE-2017-14981 Cross-site scripting in n/a

Medium 5.4 Published 2 Oct 2017 Updated 17 Sep 2024

An attacker can inject arbitrary HTML and script code into the ATutor LMS via the RSS feed editor, potentially compromising user sessions.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2017-14981?

CVE-2017-14981 is a medium-severity cross-site scripting vulnerability in n/a, published on 2 Oct 2017. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Cross-Site Scripting (XSS) was discovered in ATutor before 2.2.3. The vulnerability exists due to insufficient filtration of data (url in /mods/_standard/rss_feeds/edit_feed.php). An attacker could inject arbitrary HTML and script code into a browser in the context of the vulnerable website.

Weakness: CWE-79

Which versions are affected by CVE-2017-14981?

It affects 1 product.

Products include Atutor Atutor.

How do I fix CVE-2017-14981?

No fix has been published for CVE-2017-14981 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2017-14981 being exploited?

There is no known exploitation of CVE-2017-14981 in the wild and no public exploit code.

Sources

Also known as GHSA-9vq9-c8fr-pf2h.