PT-2023-25589 · Ilias · Ilias

Published 2023-06-29 · Updated 2024-11-26 · CVE-2023-36487

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ILIAS versions 7.0 beta1 through 7.20 ILIAS versions 8.0 beta1 through 8.1

Description The password reset function allows remote attackers to take over the account.

Recommendations For ILIAS versions 7.0 beta1 through 7.20, consider disabling the password reset function until a patch is available. For ILIAS versions 8.0 beta1 through 8.1, consider disabling the password reset function until a patch is available.

Fix

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2023-36487

Affected Products

Ilias

References · 7

• https://osv.dev/vulnerability/CVE-2023-36487 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-36487 · Security Note
• https://docu.ilias.de/ilias.php?ref_id=1719&obj_id=141694&obj_type=PageObject&cmd=layout&cmdClass=illmpresentationgui&cmdNode=13g&baseClass=ilLMPresentationGUI · Note
• https://docu.ilias.de/ilias.php?ref_id=1719&obj_id=141703&obj_type=PageObject&cmd=layout&cmdClass=illmpresentationgui&cmdNode=13g&baseClass=ilLMPresentationGUI · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36487 · Note
• https://t.me/cibsecurity/65734 · Telegram Post
• https://t.me/cvenotify/53327 · Telegram Post