Read the docs
TI-2024-17071 Aliases CVE-2024-25973GHSA-2q9p-5gw5-gr76

Multiple Stored Cross-Site Scripting Vulnerabilities

Priority LOW 25CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-79.

Summary

The Frentix GmbH OpenOlat LMS is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities. An attacker with rights to create or edit groups can create a course with a name that contains an XSS payload. Furthermore, attackers with the permissions to create or rename a catalog (sub-category) can enter unfiltered input in the name field. In addition, attackers who are allowed to create curriculums can also enter unfiltered input in the name field. This allows an attacker to execute stored JavaScript code with the permissions of the victim in the context of the user's browser.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00561 46th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenOLATOpenOlat LMSup to 18.1.4—No fix listedCNA
  • OpenOlat LMS VendorOpenOLAT Affected up to 18.1.4 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:frentix:openolat:*:*:*:*:*:*:*:*before 18.1.6VulnerableOpenOLAT
  • cpe:2.3:a:frentix:openolat:*:*:*:*:*:*:*:* Versions before 18.1.6 Vulnerable ·OpenOLAT

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-25973
  2. 2026-10-03 Alias added: GHSA-2q9p-5gw5-gr76

References

Exploit 2

  • TI-2024-17072 Stored Cross-Site Scripting (XSS) within the Media Center CVSS 3.1MEDIUM 5.4
  • TI-2026-24492 OpenOLAT: Authentication bypass via forged JWT in OIDC implicit flow CVSS 3.1CRITICAL 9.8
  • TI-2021-16566 Path Traversal in Archive Handling Leading to Code Execution CVSS 3.1HIGH 8.8
  • TI-2021-16567 Unsafe Deserialization of User Data Using XStream CVSS 3.1HIGH 8.8
  • TI-2026-22563 OpenOLAT: Server-Side Template Injection (SSTI) in Velocity templates allows Remote Code Execution CVSS 3.1HIGH 8.8
  • TI-2021-18077 Path Traversal in some REST methods leading to file upload to arbitrary places CVSS 3.1HIGH 8.1
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences