Access Control Flaw in Chamilo Learning Management System
CVE-2023-34958

4.3MEDIUM

Key Information:

Vendor

Chamilo

Status
Chamilo Lms
Vendor
CVE Published:
8 June 2023

What is CVE-2023-34958?

An access control vulnerability in Chamilo Learning Management System versions 1.11.* through 1.11.18 permits unauthorized document downloads. Specifically, students enrolled in the same course can access and download documents belonging to other students if they obtain the document's ID. This flaw arises from improper access restrictions, posing a risk to user privacy and data confidentiality.

References

https://support.chamilo.org/projects/1/wiki/Security_issu...
https://github.com/chamilo/chamilo-lms/commit/0c1c29db188...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.