PT-2018-15311 · Chamilo · Chamilo Lms

Publicado 2018-12-21 · Atualizado 2019-01-07 · CVE-2018-20328

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Chamilo LMS version 1.11.8

Description The issue allows authenticated users to affect other users under specific conditions of permissions granted by administrators. It is considered low risk due to the nature of the feature it exploits. The problem is related to the social groups tool in the main/social/group view.php file.

Recommendations For Chamilo LMS version 1.11.8, consider restricting access to the social groups tool until a fix is available, or apply specific configuration changes to limit the permissions that can be granted by administrators to mitigate the risk.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-20328

Produtos afetados

Chamilo Lms

Referências · 4

• https://github.com/chamilo/chamilo-lms/commit/5e61c2b0fcc938ca687b8d4e593b1500aa52a034 · Correção
• https://osv.dev/vulnerability/CVE-2018-20328 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-20328 · Nota de Segurança
• https://support.chamilo.org/projects/1/wiki/Security_issues#Issue-32-2018-11-28-Low-risk-More-XSS-and-path-disclosure-issues · Correção