关键漏洞信息 CVE ID: CVE-2023-4119 NVD Published Date: 2023-08-03 NVD Last Modified: 2024-11-21 Vulnerability Description: - 存在于Academy LMS 6.0中的一个漏洞被分类为有问题。此漏洞影响文件/academy/home/courses中未知代码的部分。通过操纵query/sort_by参数可导致跨站脚本（XSS）。攻击可远程触发。VDB-235966是此漏洞的唯一标识符。 - 注意：已提前联系供应商，但未收到回应。 CVSS Scores: - NIST: - Base Score: 6.1 (中等) - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CNA: VulDB - Base Score: 4.3 (中等) - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N References: - http://packetstormsecurity.com/files/173941/Academy-LMS-6.0-Cross-Site-Scripting.html - https://vuldb.com/?ctiid.235966 - https://vuldb.com/?id.235966 Weakness: - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected Software: - creativeitem:academy_lms:6.0