PT-2026-5151 · Ilias.De+2 · Ilias Learning Management System+1

Dot/Kx1Z0 · CVE-2020-36944 · Publicado 2026-01-28 · Atualizado 2026-02-09

Positive Technologies (AI Summary)

CVSS v3.1

4.0

Média

Vetor base

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions ILIAS Learning Management System version 4.3

Description The ILIAS Learning Management System contains a server-side request forgery issue. This allows attackers to read local files through the portfolio PDF export functionality. Attackers can inject a script that uses XMLHttpRequest to retrieve local file contents when a portfolio is exported to PDF. The vulnerable functionality involves the use of XMLHttpRequest to access local files.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2020-36944

Produtos afetados

Ilias Learning Management System

Ilias

Referências · 7

• 🔥 https://exploit-db.com/exploits/49148 · Exploit
• https://github.com/ILIAS-eLearning/ILIAS · Nota
• https://osv.dev/vulnerability/CVE-2020-36944 · Aviso do Fabricante
• https://t.me/cveNotify/151454 · Publicação no Telegram
• https://ilias.de · Nota
• https://vulncheck.com/advisories/ilias-learning-management-system-ssrf · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2020-36944 · Nota de Segurança