Beakon LMS SCORM CVE-2025-46102
MEDIUMSeverity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Reflected XSS requiring low-privilege attacker account and victim interaction; scope changes to browser context enabling cookie theft.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
Cross Site Scripting vulnerability in Beakon Software Beakon Learning Management System Sharable Content Object Reference Model (SCORM) version V.5.4.3 allows a remote attacker to obtain sensitive information via the URL parameter
AnalysisAI
Reflected XSS in Beakon Learning Management System SCORM v5.4.3 allows an authenticated remote attacker to inject arbitrary JavaScript into a victim's browser session via the unsanitized url parameter of the SCORM loader endpoint. The PoC published on PacketStorm demonstrates direct cookie theft using a javascript:alert(document.cookie) payload, confirming the vulnerability is exploitable without specialized tooling. No patch has been identified at time of analysis; no public exploit identified at time of analysis beyond the published PoC, and EPSS at 0.25% (17th percentile) reflects low observed exploitation activity consistent with a niche product.
Technical ContextAI
The affected component is the SCORM (Sharable Content Object Reference Model) content loader page at /courses/lms/scorm/loader.html, which accepts a url query parameter. The parameter is passed to the browser without output encoding, allowing a javascript: URI scheme to be interpreted directly - a classic CWE-79 (Improper Neutralization of Input During Web Page Generation / Reflected XSS) pattern. The CVSS scope change (S:C) confirms the injected script executes in the victim's browser context rather than being contained by the server-side application boundary. The CPE string cpe:2.3:a:beakon:learning_management_system_sharable_content_object_reference_model:*:*:*:*:*:*:*:* uses a wildcard version field, meaning NVD has not bounded the affected range beyond the reported version 5.4.3.
RemediationAI
No vendor-released patch has been identified at time of analysis. Organizations should contact Beakon Software directly at https://beakon.com.au to obtain an updated build or hotfix. As an immediate compensating control, deploy a WAF rule blocking requests to the SCORM loader endpoint (/courses/lms/scorm/loader.html) where the url parameter contains javascript:, data:, or other non-HTTP(S) schemes - note this may impact legitimate SCORM content that dynamically references external URLs, so test against course content before enforcing in blocking mode. Additionally, enforce a strict Content-Security-Policy response header with script-src 'self' and default-src 'self' to prevent inline script execution even if the parameter is injected; CSP deployment may require application-side changes if inline scripts are currently used elsewhere in the LMS. Restricting access to the SCORM loader to specific authenticated roles (e.g., enrolled students only, not public-facing) further reduces the attack surface.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today