PT-2022-20754 · Ilias · Ilias Usertakeover Plugin

Published 2022-06-21 · Updated 2022-06-28 · CVE-2022-31478

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions ILIAS UserTakeOver plugin versions prior to 4.0.1

Description The issue allows an attacker to list all users via the search function.

Recommendations For versions prior to 4.0.1, update to version 4.0.1 or later to resolve the issue.

Fix

Related Identifiers

CVE-2022-31478

Affected Products

Ilias Usertakeover Plugin

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-31478 · Security Note
• https://osv.dev/vulnerability/CVE-2022-31478 · Vendor Advisory
• https://github.com/srsolutionsag/UserTakeOver · Note
• https://medium.com/%40bcksec/ilias-lms-usertakeover-4-0-1-vulnerability-b2824679403 · Note
• https://t.me/cibsecurity/44907 · Telegram Post