CyberRota Analysis
AI-GeneratedThe Sakai Conversations tool in versions 23.0 to 23.4 and 25.0 to 25.2 is vulnerable to stored cross-site scripting (XSS) due to improper HTML sanitization, allowing authenticated users to inject malicious scripts that execute in the browsers of other users. This vulnerability poses a significant risk, as it can lead to unauthorized data access and user session hijacking. Organizations using affected versions should prioritize patching to versions 23.5, 25.3, or 26.0 to mitigate this high-severity threat.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Sakai is a Collaboration and Learning Environment (CLE). From versions 23.0 to before 23.5, and versions 25.0 to before 25.3, the Sakai Conversations tool stores topic and post messages without HTML sanitization, and the frontend renders them using LitElement's unsafeHTML() directive, resulting in stored cross-site scripting (XSS). Any authenticated user with access to a site that has the Conversations tool enabled can inject arbitrary HTML and JavaScript that executes in the browsers of all other users who view that topic or post. This issue has been patched in versions 23.5, 25.3, and 26.0.