CVE-2021-37391

🗓️ 10 Aug 2021 19:02:34Reported by mitreType

cve🔗 web.nvd.nist.gov👁 67 Views🌐 WEB

A user without privileges in Chamilo LMS 1.11.14 can send an invitation message to another user and execute arbitrary code

Reporter	Title	Published	Views	Family All 11
0day.today	Chamilo LMS 1.11.14 - Account Takeover Vulnerability	2 Feb 202200:00	–	zdt
Circl	CVE-2021-37391	11 Aug 202100:37	–	circl
CNNVD	Chamilo LMS 跨站脚本漏洞	10 Aug 202100:00	–	cnnvd
Cvelist	CVE-2021-37391	10 Aug 202119:02	–	cvelist
Exploit DB	Chamilo LMS 1.11.14 - Account Takeover	2 Feb 202200:00	–	exploitdb
EUVD	EUVD-2021-23960	7 Oct 202500:30	–	euvd
NVD	CVE-2021-37391	10 Aug 202120:15	–	nvd
OpenVAS	Chamilo LMS < 1.11.16 Multiple Vulnerabilities	11 Aug 202100:00	–	openvas
Packet Storm	Chamilo LMS 1.11.14 Cross Site Scripting / Account Takeover	2 Feb 202200:00	–	packetstorm
Prion	Cross site scripting	10 Aug 202120:15	–	prion

NVD

Node

chamilo chamilo_lmsRange1.11.0–1.11.14

Source	Link
gitbook	www.gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chamilo-lms-1.11.14-xss-vulnerabilities
github	www.github.com/chamilo/chamilo-lms/commit/de43a77049771cce08ea7234c5c1510b5af65bc8

Parameter	Position	Path	Description	CWE
text	request body	/main/social/search.php	Stored XSS vulnerability via the send invitation feature in the social network path	CWE-79
text	request body	/main/inc/lib/social.lib.php	Stored XSS handling in social library used by the invitation feature	CWE-79

21 Nov 2024 06:15Current

6Medium risk

Vulners AI Score6

CVSS 23.5

CVSS 3.15.4

EPSS0.00556