CVE-2017-15538

—

CVSS 3.0

5.4 medium

EPSS

<1%p59

Published

Oct 17, 2017 (Oct 17, 2017)

Modified

Jun 17, 2026

Description

Stored XSS vulnerability in the Media Objects component of ILIAS before 5.1.21 and 5.2.x before 5.2.9 allows an authenticated user to inject JavaScript to gain administrator privileges, related to the setParameter function in Services/MediaObjects/classes/class.ilMediaItem.php.

Vendors: ilias
Products: ilias
Weakness: CWE-79
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.9%)

In the news0 stories

No ingested article mentions this CVE yet.