CVE-2024-33526

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-33526
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-33526.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-33526
Published
2024-05-21T14:52:30.339Z
Modified
2026-07-08T06:55:35.437636504Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L CVSS Calculator
Summary
[none]
Details

A Stored Cross-site Scripting (XSS) vulnerability in the "Import of user role and title of user role" feature in ILIAS 7 before 7.30 and ILIAS 8 before 8.11 allows remote authenticated attackers with administrative privileges to inject arbitrary web script or HTML via XML file upload.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "DESCRIPTION",
            "extracted_events": [
                {
                    "introduced": "7"
                },
                {
                    "fixed": "7.30"
                },
                {
                    "introduced": "8"
                },
                {
                    "fixed": "8.11"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/33xxx/CVE-2024-33526.json",
    "cna_assigner": "mitre"
}
References

Affected packages

Git / github.com/ilias-elearning/ilias

Affected ranges

Type
GIT
Repo
https://github.com/ilias-elearning/ilias
Events
Introduced
a69e33436c7961b4ae12398300443d952e02f4f2
Fixed
a6dff28dab7b15c7f75e0428729c5d7f98c04c3a
Introduced
8ae8387e9d7f958cf88a9dd37fd542195a473dd1
Fixed
15d9e8f67fe57711c5b1126e6066d19bbdf66956
Database specific 
{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:ilias:ilias:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "7.0"
        },
        {
            "fixed": "7.30"
        },
        {
            "introduced": "8.0"
        },
        {
            "fixed": "8.11"
        }
    ]
}

Affected versions

v7.*
v7.0
v7.1
v7.10
v7.13
v7.14
v7.17
v7.18
v7.19
v7.2
v7.21
v7.23
v7.24
v7.25
v7.26
v7.27
v7.28
v7.29
v7.3
v7.4
v7.6
v7.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-33526.json"