SQL Injection Vulnerability in Chamilo LMS by Chamilo Foundation
CVE-2023-39582

4.9MEDIUM

Key Information:

Vendor

Chamilo

Status
Chamilo Lms
Vendor
CVE Published:
1 September 2023

What is CVE-2023-39582?

A SQL Injection vulnerability exists in Chamilo LMS versions 1.11 through 1.11.20. This flaw allows remote, authenticated attackers to exploit the import sessions functionalities to gain unauthorized access to sensitive information, potentially compromising the integrity of user data. The risk is particularly critical as it can be leveraged by users with administrative privileges, highlighting the need for immediate attention and remediation.

References

https://support.chamilo.org/projects/chamilo-18/wiki/Secu...

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.