Dokeos Code Execution and Cross-Site Scripting

Sunday, 16 March 2008

Description:
Some vulnerabilities have been reported in Dokeos, which can be exploited by malicious people to conduct cross-site scripting attacks or to compromise a vulnerable system.

The vulnerabilities are caused due to unspecified errors, which can be exploited to conduct cross-site scripting attacks or compromise a vulnerable system. No further information is currently available.

The vulnerabilities are reported in version 1.8.4. Other versions may also be affected.

Solution:
Apply Dokeos 1.8.4 SP3:
http://www.dokeos.com/download/dokeos-1.8.4-SP3.zip

Provided and/or discovered by:
The vendor credits Allegro.pl.

Changelog:
2008-03-11: Added CVE reference.

Original Advisory:
http://www.dokeos.com/wiki/index.php/Security

http://secunia.com/advisories/29254/