Lucene search

[email protected]CVE-2023-34944

HistoryJun 13, 2023 - 9:15 p.m.

CVE-2023-34944

2023-06-1321:15:10

CWE-434

[email protected]

web.nvd.nist.gov

126

cve-2023-34944

arbitrary file upload

security vulnerability

chamilo 1.11.*

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.5 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

37.2%

JSON

An arbitrary file upload vulnerability in the /fileUpload.lib.php component of Chamilo 1.11.* up to v1.11.18 allows attackers to execute arbitrary code via uploading a crafted SVG file.

CPENameOperatorVersion
chamilo:chamilo_lmschamilo chamilo lmsle1.11.18
chamilo:chamilo_lmschamilo chamilo lmseq1.11.4
chamilo:chamilo_lmschamilo chamilo lmseq1.11.14
chamilo:chamilo_lmschamilo chamilo lmseq1.11.0
chamilo:chamilo_lmschamilo chamilo lmseq1.11.10
chamilo:chamilo_lmschamilo chamilo lmseq1.11.12
chamilo:chamilo_lmschamilo chamilo lmseq1.11.8
chamilo:chamilo_lmschamilo chamilo lmseq1.11.6
chamilo:chamilo_lmschamilo chamilo lmseq1.11.2
chamilo:chamilo_lmschamilo chamilo lmseq1.11.16

CPE	Name	Operator	Version
chamilo:chamilo_lms	chamilo chamilo lms	le	1.11.18
chamilo:chamilo_lms	chamilo chamilo lms	eq	1.11.4
chamilo:chamilo_lms	chamilo chamilo lms	eq	1.11.14
chamilo:chamilo_lms	chamilo chamilo lms	eq	1.11.0
chamilo:chamilo_lms	chamilo chamilo lms	eq	1.11.10
chamilo:chamilo_lms	chamilo chamilo lms	eq	1.11.12
chamilo:chamilo_lms	chamilo chamilo lms	eq	1.11.8
chamilo:chamilo_lms	chamilo chamilo lms	eq	1.11.6
chamilo:chamilo_lms	chamilo chamilo lms	eq	1.11.2
chamilo:chamilo_lms	chamilo chamilo lms	eq	1.11.16

Rows per page:

1-10 of 111

References

chamilo.com

github.com/chamilo/chamilo-lms/commit/0d0c88c4806280ac9b70a299d6e3099269c9bc54

github.com/chamilo/chamilo-lms/commit/f6e83550c2d17fc93a65ec4be602a78312289f37

support.chamilo.org/projects/chamilo-18/wiki/Security_issues#Issue-113-2023-05-31-Low-impact-Low-risk-XSS-through-SVG

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.5 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

37.2%

JSON

Related for CVE-2023-34944

prion1 osv1 cvelist1 openvas1