Lucene search

GoogleOSV:CVE-2023-34962

HistoryJun 08, 2023 - 7:15 p.m.

CVE-2023-34962

2023-06-0819:15:10

Google

osv.dev

access control

personal notes

chamilo v1.11.x

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

7 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

35.1%

JSON

Incorrect access control in Chamilo v1.11.x up to v1.11.18 allows a student to arbitrarily access and modify another student’s personal notes.

CPENameOperatorVersion
chamilo-lmseq1.10.x.pre-doctrine
chamilo-lmseq1.11.6-alpha.1
chamilo-lmseq1.9.8
chamilo-lmseqCHAMILO_1_9_6_STABLE
chamilo-lmseqCHAMILO_1_9_2_STABLE_QUARTER
chamilo-lmseq1.11.8
chamilo-lmseqCHAMILO_1_8_6_2_STABLE
chamilo-lmseqCHAMILO_1_8_7_RC_1
chamilo-lmseq1.11.12
chamilo-lmseqCHAMILO_1_9_0_ALPHA_2

Name	Operator	Version
chamilo-lms	eq	1.10.x.pre-doctrine
chamilo-lms	eq	1.11.6-alpha.1
chamilo-lms	eq	1.9.8
chamilo-lms	eq	CHAMILO_1_9_6_STABLE
chamilo-lms	eq	CHAMILO_1_9_2_STABLE_QUARTER
chamilo-lms	eq	1.11.8
chamilo-lms	eq	CHAMILO_1_8_6_2_STABLE
chamilo-lms	eq	CHAMILO_1_8_7_RC_1
chamilo-lms	eq	1.11.12
chamilo-lms	eq	CHAMILO_1_9_0_ALPHA_2

Rows per page:

1-10 of 671

References

github.com/chamilo/chamilo-lms/commit/19af444d2da9e5a60f02b4ebe7755cdff36709cd

github.com/chamilo/chamilo-lms/commit/f9a17bfaf05994383bca5f4b65eb6897acc60d41

support.chamilo.org/projects/1/wiki/Security_issues#Issue-106-2023-04-15-Moderate-impact-Moderate-risk-A-student-can-access-and-modify-another-students-personal-notes

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

7 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

35.1%

JSON

Related for OSV:CVE-2023-34962