CVE-2019-16148: Cross-site scripting in Sakai
Summary
CVE-2019-16148: Cross-site scripting in Sakai. Affects org.sakaiproject:chat-base versions < 12.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Sakai is an open-source learning management system designed for educational institutions. It provides various features for online collaboration, including a chat module. The chat module is implemented in the 'org.sakaiproject:chat-base' package. This package is part of the Maven ecosystem and can be identified using the package URL 'pkg:maven/org.sakaiproject/chat-base'. The vulnerability in Sakai version 12.6 and below allows for cross-site scripting (XSS) attacks through the chat user name.
Vulnerability Detail
The vulnerability in Sakai allows an attacker to inject malicious scripts into the chat user name, which can then be executed by unsuspecting users. This can lead to various security risks, such as stealing sensitive information, session hijacking, or performing actions on behalf of the user. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level. The Common Weakness Enumeration (CWE) ID associated with this vulnerability is CWE-79, which refers to improper neutralization of input during web page generation ('Cross-site Scripting').
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, administrators can disable the chat module in Sakai until the vulnerability is fixed. This can be done by modifying the configuration or disabling the corresponding module/plugin. However, this workaround may impact the functionality of the system, especially if the chat module is actively used for collaboration.
Conclusion
The cross-site scripting vulnerability in Sakai version 12.6 and below can be exploited by injecting malicious scripts into the chat user name. This can lead to various security risks, including data theft and unauthorized actions. It is recommended to upgrade to a non-affected version of Sakai and regularly apply updates to ensure the latest security fixes are in place. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.sakaiproject:chat-base →
FAQ
The vulnerability allows an attacker to execute malicious scripts in the context of the affected user's browser. This can lead to various security risks, including data theft, session hijacking, and unauthorized actions on behalf of the user.
You can use the Vulert Playground at Vulert Scanner to check if your Sakai installation is affected by this vulnerability. Simply provide the pom.xml file of your Sakai project, and Vulert will analyze it for any known vulnerabilities, including this XSS issue.
At the time of this report, there are no known public exploits specifically targeting this vulnerability in Sakai. However, it is important to address the issue promptly to prevent any potential exploitation.
Yes, a patch for this vulnerability is available in the latest version of Sakai. It is recommended to upgrade to the latest version to ensure the necessary security fixes are applied.
As a temporary workaround, you can disable the chat module in Sakai until the vulnerability is fixed. However, this may impact the functionality of the system, especially if the chat module is actively used for collaboration.
