PT-2021-10994 · Ilias · Ilias

Holger Fuhrmannek · Published 2021-05-13 · Updated 2022-10-26 · CVE-2020-23995

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: ILIAS versions prior to 5.3.19 ILIAS versions prior to 5.4.12 ILIAS versions prior to 6.0

Description: An information disclosure issue allows remote authenticated attackers to obtain the upload data path via a workspace upload.

Recommendations: For versions prior to 5.3.19, update to version 5.3.19 or later. For versions prior to 5.4.12, update to version 5.4.12 or later. For versions prior to 6.0, update to version 6.0 or later.

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2020-23995

Affected Products

Ilias

References · 8

• https://github.com/ILIAS-eLearning/ILIAS/commit/94d9b16010ec3abeae8d2cbb05622ccd999119ad · Patch
• https://docu.ilias.de/goto_docu_pg_124761_35.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-23995 · Vendor Advisory
• https://docu.ilias.de/goto_docu_pg_122177_35.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-23995 · Security Note
• https://docu.ilias.de/goto_docu_pg_118817_35.html · Vendor Advisory
• https://cwe.mitre.org/data/definitions/209.html · Note
• https://t.me/cvenotify/14820 · Telegram Post