PT-2022-23846 · Claroline · Claroline

Matthieu-Hackwitharts · Published 2022-08-25 · Updated 2022-08-27 · CVE-2022-37159

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Claroline versions 13.5.7 and prior

Description The issue allows for remote code execution via arbitrary file upload.

Recommendations For versions 13.5.7 and prior, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-37159

Affected Products

Claroline

References · 4

• 🔥 https://github.com/matthieu-hackwitharts/claroline-CVEs/blob/main/rce/rce_file_upload.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-37159 · Security Note
• https://osv.dev/vulnerability/CVE-2022-37159 · Vendor Advisory
• https://t.me/cibsecurity/48785 · Telegram Post