A vulnerability was found in Chamilo LMS up to 1.11.20 (Content Management System). It has been rated as problematic. This issue affects some unknown functionality of the component Languages Management. The manipulation with an unknown input leads to a cross site scripting vulnerability. Using CWE to declare the problem leads to CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Impacted is integrity. The summary by CVE is:

Chamilo 1.11.x up to 1.11.20 allows users with an admin privilege account to insert XSS in the languages management section.

The weakness was presented 07/08/2023 as 75e9b3e0acac6f7a643da6ff19a00d55a94417a1. The advisory is shared at github.com. The identification of this vulnerability is CVE-2023-37061 since 06/28/2023. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1059.007 for this issue.

Applying the patch 75e9b3e0acac6f7a643da6ff19a00d55a94417a1 is able to eliminate this problem. The bugfix is ready for download at github.com.

Productinfo

Type

• Content Management System

Vendor

• Chamilo

Name

• LMS

Version

• 1.11.0
• 1.11.1
• 1.11.2
• 1.11.3
• 1.11.4
• 1.11.5
• 1.11.6
• 1.11.7
• 1.11.8
• 1.11.9
• 1.11.10
• 1.11.11
• 1.11.12
• 1.11.13
• 1.11.14
• 1.11.15
• 1.11.16
• 1.11.17
• 1.11.18
• 1.11.19
• 1.11.20

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion