CVE-2023-2822

Deeper analysis

A reflected cross-site scripting vulnerability exists in Ellucian Ethos Identity versions up to 5.10.5. The issue resides in an unknown function of the /cas/logout endpoint, where unsanitized input to the url parameter allows arbitrary script injection. The flaw is tracked as CWE-79 and carries a CVSS 3.1 base score of 4.3.

An unauthenticated remote attacker can exploit the weakness by supplying a crafted URL that is later rendered in a victim's browser. Successful exploitation permits the attacker to execute script in the context of the affected user, resulting in limited integrity impact such as content modification or session manipulation. The attack requires user interaction, typically in the form of clicking a malicious link.

The vendor has addressed the issue in version 5.10.6. Public references, including a detailed disclosure on Medium, confirm that the exploit code has been released and recommend immediate upgrade of the affected component.

The associated EPSS score currently stands at 0.8099 with a recorded peak of 0.8367, indicating sustained moderate exploitation interest following public disclosure.