PT-2018-15198 · Chamilo · Chamilo Lms

Publicado 2018-07-23 · Atualizado 2019-09-17 · CVE-2018-1999019

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Chamilo LMS versions prior to the version containing commit 0de84700648f098c1fbf6b807dee28ec640efe62

Description The issue concerns an Unserialization vulnerability in the hash GET parameter for the API endpoint located at "/webservices/api/v2.php". This can result in Unauthenticated remote code execution via a simple GET request to the API endpoint.

Recommendations For versions prior to the one containing commit 0de84700648f098c1fbf6b807dee28ec640efe62, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the "/webservices/api/v2.php" API endpoint to minimize the risk of exploitation. Avoid using the hash parameter in the affected API endpoint until the issue is resolved.

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2018-1999019

Produtos afetados

Chamilo Lms

Referências · 4

• https://github.com/chamilo/chamilo-lms/commit/0de84700648f098c1fbf6b807dee28ec640efe62 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2018-1999019 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-1999019 · Aviso do Fabricante
• https://ibb.co/jBxe6y · Nota