Medium severity5.4NVD Advisory· Published Oct 17, 2017· Updated Jun 17, 2026

CVE-2017-15538

Description

Stored XSS vulnerability in the Media Objects component of ILIAS before 5.1.21 and 5.2.x before 5.2.9 allows an authenticated user to inject JavaScript to gain administrator privileges, related to the setParameter function in Services/MediaObjects/classes/class.ilMediaItem.php.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Ilias/Ilias2 versions
cpe:2.3:a:ilias:ilias:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:ilias:ilias:*:*:*:*:*:*:*:*range: <=5.1.21
- (no CPE)range: <5.1.21, <5.2.9

Patches

Vulnerability mechanics

References

openwall.com/lists/oss-security/2017/10/17/3nvdMailing ListPatchThird Party Advisory
github.com/ILIAS-eLearning/ILIAS/commit/b2a4660afec1e87d41c83c8e381f549bc6dfc70fnvdIssue TrackingPatchThird Party Advisory
lists.ilias.de/pipermail/ilias-admins/2017-October/000053.htmlnvdVendor Advisory
www.ilias.de/docu/goto_docu_pg_75377_35.htmlnvdIssue TrackingRelease NotesVendor Advisory
www.ilias.de/docu/goto_docu_pg_75378_1719.htmlnvdIssue TrackingRelease NotesVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000