PT-2021-10995 · Ilias · Ilias

Published 2021-05-13 · Updated 2021-05-21 · CVE-2020-23996

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: ILIAS versions prior to 5.3.19 ILIAS versions prior to 5.4.10 ILIAS versions prior to 6.0

Description: A local file inclusion issue allows remote authenticated attackers to execute arbitrary code via the import of personal data.

Recommendations: For versions prior to 5.3.19, update to version 5.3.19 or later. For versions prior to 5.4.10, update to version 5.4.10 or later. For versions prior to 6.0, update to version 6.0 or later.

Fix

Related Identifiers

CVE-2020-23996

Affected Products

Ilias

References · 7

• https://github.com/ILIAS-eLearning/ILIAS/commit/6717c4ecc6d076154ce185f1ea052f07f37e3537 · Patch
• https://osv.dev/vulnerability/CVE-2020-23996 · Vendor Advisory
• https://docu.ilias.de/goto_docu_pg_122177_35.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-23996 · Security Note
• https://docu.ilias.de/goto_docu_pg_118817_35.html · Vendor Advisory
• https://docu.ilias.de/goto_docu_pg_118823_35.html · Vendor Advisory
• https://t.me/cvenotify/14819 · Telegram Post