PT-2021-10839 · Unknown · Chamilo Lms

Hoang Kien + 1 · Published 2021-05-05 · Updated 2021-05-07 · CVE-2020-23127

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Chamilo LMS version 1.11.10

Description The issue is related to Cross Site Request Forgery (CSRF) via the edit user function, which can be exploited by targeting an admin user. This allows for unauthorized actions to be performed on behalf of the admin.

Recommendations For Chamilo LMS version 1.11.10, consider disabling the edit user function until a patch is available to prevent CSRF attacks. Restrict access to admin user accounts to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2020-23127

Affected Products

Chamilo Lms

References · 5

• 🔥 https://toandak.blogspot.com/2020/05/csrf-vulnerbility-in-chamilo-lms.html · Exploit
• https://support.chamilo.org/projects/chamilo-18/wiki/Security_issues#Issue-41-2020-04-22-Medium-risk-high-impact-CSRF-and-privilege-escalation-via-CSRF · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-23127 · Security Note
• https://osv.dev/vulnerability/CVE-2020-23127 · Vendor Advisory
• https://t.me/cvenotify/14283 · Telegram Post