PT-2024-22332 · Drawio+1 · Drawio+1

Gnaegi · Published 2024-03-11 · Updated 2024-03-12 · CVE-2024-28198

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenOlat versions prior to 18.1.6 OpenOlat versions prior to 18.2.2

Description OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication. By manually manipulating http requests when using the draw.io integration, it is possible to read arbitrary files as the configured system user and perform Server-Side Request Forgery (SSRF).

Recommendations For versions prior to 18.1.6, upgrade to the latest version of 18.1.x. For versions prior to 18.2.2, upgrade to the latest version of 18.2.x. As a temporary workaround, consider disabling the Draw.io module or the entire REST API to secure the system.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2024-28198

GHSA-PQVM-H9MG-434C

Affected Products

Openolat

Drawio

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28198.json · Exploit
• https://github.com/OpenOLAT/OpenOLAT/security/advisories/GHSA-pqvm-h9mg-434c · Vendor Advisory
• https://github.com/OpenOLAT/OpenOLAT/commit/23e6212e9412c3b099436159b8c8935321c91872 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-28198 · Security Note
• https://osv.dev/vulnerability/CVE-2024-28198 · Vendor Advisory
• https://twitter.com/CVEnew/status/1767277439011422540 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1767318596663779454 · Twitter Post
• https://track.frentix.com/issue/OO-7553/XXE-injection-in-draw.io-endpoint · Note
• https://t.me/cvenotify/73507 · Telegram Post