Recent Vulnerabilities Research Posts Trends Blog About Contact

Published: 25/08/2022 Updated: 27/08/2022

CVSS v3 Base Score: 5.4 | Impact Score: 2.7 | Exploitability Score: 2.3

VMScore: 0

Claroline 13.5.7 and prior is vulnerable to Cross Site Scripting (XSS). An attacker can obtain javascript code execution by adding arbitrary javascript code in the 'Location' field of a calendar event.

Vulnerable Product	Search on Vulmon	Subscribe to Product
claroline claroline

claroline-CVEs This repo describes several vulns found in Claroline Connect app, in its current version : 1357 RCE via arbitrary file upload (CVE-2022-37159) : githubcom/matthieu-hackwitharts/claroline-CVEs/blob/main/rce/rce_file_uploadmd 'Location' stored XSS (CVE-2022-37162) : githubcom/matthieu-hackwitharts/claroline-CVEs/blob/main/calendar_xs

CWE-79 https://github.com/matthieu-hackwitharts/claroline-CVEs/blob/main/calendar_xss/calendar_xss.md https://nvd.nist.gov https://github.com/matthieu-hackwitharts/claroline-CVEs

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2022-37162

Vulnerability Summary

Vulnerability Trend

Github Repositories

References

Vulmon Search

About

Products

Connect