Access Control Flaw in Chamilo Learning Management System
CVE-2023-34958
4.3MEDIUM
What is CVE-2023-34958?
An access control vulnerability in Chamilo Learning Management System versions 1.11.* through 1.11.18 permits unauthorized document downloads. Specifically, students enrolled in the same course can access and download documents belonging to other students if they obtain the document's ID. This flaw arises from improper access restrictions, posing a risk to user privacy and data confidentiality.
References
CVSS V3.1
Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved