Lucene search
HistoryNov 28, 2023 - 8:15 a.m.
CVE-2023-4220
unauthenticated
file upload
remote code execution
cross-site scripting
web shell
chamilo lms
CVSS3
6.1
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
0.026
Percentile
90.5%
Unrestricted file upload in big file upload functionality in /main/inc/lib/javascript/bigupload/inc/bigUpload.php in Chamilo LMS <= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell.
Affected configurations
Node
chamilochamilo_lmsRange≤1.11.24
| Vendor | Product | Version | CPE |
|---|---|---|---|
| chamilo | chamilo_lms | * | cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:* |
References
Related
cve
cve
CVE-2023-4220
2023-11-28 08:15:07
githubexploit
githubexploit
osv
osv
CVE-2023-4220
2023-11-28 08:15:07
nuclei
nuclei
Chamilo LMS <= 1.11.24 - Remote Code Execution
2024-07-09 14:56:08
prion
prion
Cross site scripting
2023-11-28 08:15:00
cvelist
cvelist
openvas
openvas
Chamilo LMS 1.11.x < 1.11.24 Multiple Vulnerabilities
2023-12-01 00:00:00
CVSS3
6.1
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
0.026
Percentile
90.5%
Related for NVD:CVE-2023-4220