Input validation error in OpenOlat - #VU128163
Published: March 11, 2024 / Updated: April 27, 2026
Vulnerability identifier: #VU128163
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to inject malicious HTML content into emails.
The vulnerability exists due to improper input validation in email templates when sending email messages containing user-supplied values. A remote user can enter specially crafted content to inject malicious HTML content into emails.
User interaction is required to view the crafted email content.
Affected software
OpenOlat
Remediation
Install security update from vendor's website.
OpenOlat - addressed in versions 17.2.15, 18.0.5