The RELATE courseware package contains a stored cross-site scripting vulnerability that could allow an authenticated attacker to perform unauthorized actions on behalf of other users.

This is a stored Cross-Site Scripting (XSS) vulnerability (CWE-79) within the courseware administration interface. It requires an authenticated user with sufficient privileges to inject malicious input that is subsequently executed in the browser of other users, including administrators.

An attacker exploiting this vulnerability could hijack administrative sessions, modify course content, or perform unauthorized administrative actions. The CVSS score of 8.7 reflects the high potential for impact on integrity and confidentiality, as the flaw allows for the execution of scripts within the context of the application's administrative domain.

Immediate Action: Update the RELATE installation by pulling the latest source code from the main repository, specifically ensuring the inclusion of commit 555f0efb1c5bd7531c07cd73724d7e566a81f620.

Proactive Monitoring: Audit administrative logs for suspicious input patterns or unexpected changes to course configuration settings.

Compensating Controls: Implement strict Content Security Policy (CSP) headers to restrict the execution of unauthorized scripts within the browser.

Public Exploit Available: No (exploit_available: false)

Administrators must verify their current version of RELATE against the repository commit history and apply the necessary security patch immediately. Due to the high risk to administrative integrity, restrict access to the courseware management interface to authorized personnel only.