PT-2021-10840 · Unknown · Chamilo Lms

Hoang Kien + 1 · Published 2021-05-05 · Updated 2021-05-11 · CVE-2020-23128

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Chamilo LMS version 1.11.10

Description The issue is related to improper privilege management. A user with Sessions administrator privilege can create a new user and then use the edit user function to change this new user to administrator privilege.

Recommendations For Chamilo LMS version 1.11.10, consider restricting the use of the edit user function to prevent users from escalating their privileges until a proper fix is available. As a temporary workaround, monitor user account changes closely to detect and mitigate any potential misuse of privileges. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2020-23128

Affected Products

Chamilo Lms

References · 5

• 🔥 https://toandak.blogspot.com/2020/05/improper-privilege-management-in.html · Exploit
• https://support.chamilo.org/projects/chamilo-18/wiki/Security_issues#Issue-41-2020-04-22-Medium-risk-high-impact-CSRF-and-privilege-escalation-via-CSRF · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-23128 · Security Note
• https://osv.dev/vulnerability/CVE-2020-23128 · Vendor Advisory
• https://t.me/cvenotify/14130 · Telegram Post