Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitymedium

SCHUTZWERK-SA-2024-007: Stored Cross-Site Scripting via file upload in H5P module (h5p-nodejs-library) of Lumi Education

Full Disclosure ()1
Read at seclists.org
AI summary · grok-4.7Summaries by Vani AI

Stored XSS in Lumi Education h5p-nodejs-library through 10.0.4 lets uploaded H5P content run JavaScript.

SCHUTZWERK advisory SA-2024-007 describes stored cross-site scripting in Lumi Education's h5p-nodejs-library, affecting all versions up to and including 10.0.4. The library accepts H5P uploads that can contain malicious JavaScript, which then runs in the browsers of other users who open that content. The visible disclosure does not list a CVE or say the flaw is being exploited.

Key facts
  • Stored XSS via H5P file upload in h5p-nodejs-library.
  • All versions through 10.0.4 are affected.
  • Malicious JavaScript runs for other users viewing the content.
  • Published as SCHUTZWERK-SA-2024-007 on Full Disclosure.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Tags
xssstored-xssh5plumi-educationfile-uploadh5p-nodejs-libraryfull-disclosure
Vendors
Lumi Education
Products
h5p-nodejs-libraryH5P
Organizations
SCHUTZWERK

From the original article

Posted by David Brown via Fulldisclosure on Sep 22 A stored cross-site scripting (XSS) vulnerability has been identified in the H5P module h5p-nodejs-library by Lumi Education UG in versions up to and including 10. 0. 4.

Full Disclosure

seclists.org

Read the full article at Full Disclosure

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.