PT-2021-22438 · Openolat · Openolat

Gnaegi · Published 2021-08-31 · Updated 2021-09-09 · CVE-2021-39180

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenOLAT versions prior to 15.3.18 OpenOLAT versions prior to 15.5.3 OpenOLAT versions prior to 16.0.0

Description A path traversal vulnerability exists in OpenOLAT, a web-based learning management system. Using a specially prepared ZIP file, it is possible to overwrite any file that is writable by the application server user. Depending on the configuration, this can be limited to files of the OpenOlat user data directory, or it could also be used to overwrite application server config files, java code, or even operating system files. The attack could be used to corrupt or modify any OpenOlat file, such as course structures, config files, or temporary test data. If the app server configuration allows the execution of jsp files and the path to the context is known, it is also possible to execute java code. If the app server runs with the same user that is used to deploy the OpenOlat code or has write permissions on the OpenOlat code files and the path to the context is known, code injection is possible. The attack requires an OpenOlat user account to upload a ZIP file and trigger the unzip method.

Recommendations For OpenOLAT versions prior to 15.3.18, upgrade to version 15.3.18 or later. For OpenOLAT versions prior to 15.5.3, upgrade to version 15.5.3 or later. For OpenOLAT versions prior to 16.0.0, upgrade to version 16.0.0 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-39180

GHSA-X95V-2PGJ-9X8J

Affected Products

Openolat

References · 9

• https://github.com/OpenOLAT/OpenOLAT/commit/5668a41ab3f1753102a89757be013487544279d5 · Patch
• https://github.com/OpenOLAT/OpenOLAT/commit/2cf73c972e23ccd69cc1e103e43c2c8253571d3e · Patch
• https://github.com/OpenOLAT/OpenOLAT/commit/699490be8e931af0ef1f135c55384db1f4232637 · Patch
• https://jira.openolat.org/browse/OO-5549 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-39180 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39180 · Security Note
• https://github.com/OpenOLAT/OpenOLAT/security/advisories/GHSA-x95v-2pgj-9x8j · Note
• https://t.me/cvenotify/20459 · Telegram Post
• https://t.me/cibsecurity/28136 · Telegram Post