CVE-2022-2035
Medium
Description
A reflected cross-site scripting (XSS) vulnerability exists in the playerConfUrl parameter in the /defaultui/player/modern.html file for SCORM Engine versions < 20.1.45.914, 21.1.x < 21.1.7.219. The issue exists because there are no limitations on the domain or format of the url supplied by the user, allowing an attacker to craft malicious urls which can trigger a reflected XSS payload in the context of a victim's browser.
SeverityMedium
CVSS6.1
Exploit probability—
ProductLtgplc Rustici Software Scorm Engine
PublishedJun 9, 2022
First seenJun 9, 2022
How to fix
Update
- ltgplc rustici_software_scorm_engine20.1.45.914, 21.1.7.219 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ltgplc rustici_software_scorm_engine | v < 20.1.45.914, 21.1.1 ≤ v < 21.1.7.219 | 20.1.45.914, 21.1.7.219 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.