CVE-2021-24455 Tutor LMS < 1.9.2 - Authenticated Stored Cross-Site Scripting (XSS)

What is CVE-2021-24455?

CVE-2021-24455 is a medium-severity cross-site scripting vulnerability in Unknown Tutor LMS – eLearning and online course solution, published on 2 Aug 2021. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

The Tutor LMS – eLearning and online course solution WordPress plugin before 1.9.2 did not escape the Summary field of Announcements (when outputting it in an attribute), which can be created by users as low as Tutor Instructor. This lead to a Stored Cross-Site Scripting issue, which is triggered when viewing the Announcements list, and could result in privilege escalation when viewed by an admin.

Weakness: CWE-79

Which versions are affected by CVE-2021-24455?

It affects 1 product.

Products include Themeum Tutor Lms.

How do I fix CVE-2021-24455?

No fix has been published for CVE-2021-24455 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2021-24455 being exploited?

There is no known exploitation of CVE-2021-24455 in the wild and no public exploit code.

Other vulnerabilities in Unknown Tutor LMS – eLearning and online course solution

• CVE-2024-4223 Tutor LMS <= 2.7.0 - Missing Authorization Critical 9.8
• CVE-2024-4318 Tutor LMS <= 2.7.0 - Authenticated (Instructor+) SQL Injection High 8.8
• CVE-2024-4351 Tutor LMS Pro <= 2.7.0 - Missing Authorization to Privilege Escalation High 8.8
• CVE-2024-4352 Tutor LMS Pro <= 2.7.0 - Missing Authorization to SQL Injection High 8.8
• CVE-2024-1751 Tutor LMS – eLearning and online course solution <= 2.6.1 - Authenticated (Subscriber+) SQL Injection High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-mgxx-qj86-p4ch.