CVE-2024-28147 Unrestricted Upload of Files in edu-sharing
Authenticated attackers can upload malicious HTML or SVG files to trigger stored XSS or DoS via preview images in edu-sharing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-28147?
CVE-2024-28147 is a high-severity vulnerability in metaVentis GmbH edu-sharing, published on 20 Jun 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An authenticated user can upload arbitrary files in the upload function for collection preview images. An attacker may upload an HTML file that includes malicious JavaScript code which will be executed if a user visits the direct URL of the collection preview image (Stored Cross Site Scripting). It is also possible to upload SVG files that include nested XML entities. Those are parsed when a user visits the direct URL of the collection preview image, which may be utilized for a Denial of Service attack.
This issue affects edu-sharing: <8.0.8-RC2, <8.1.4-RC0, <9.0.0-RC19.
Weakness: CWE-434
Which versions are affected by CVE-2024-28147?
How do I fix CVE-2024-28147?
No fix has been published for CVE-2024-28147 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-28147 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-28147 exists.
Sources
Also known as GHSA-c87f-rj58-gx9p.