CVE-2023-3368

Critical

Description

Command injection in `/main/webservices/additional_webservices.php` in Chamilo LMS <= v1.11.20 allows unauthenticated attackers to obtain remote code execution via improper neutralisation of special characters. This is a bypass of CVE-2023-34960.

SeverityCritical

CVSS9.8

Exploit probability—

Product

Chamilo

PublishedNov 28, 2023

First seenNov 28, 2023

Weakness typeCWE-78OS command injection

How to fix

Update

chamilo chamilo1.11.20 or later

Patches

github.com/chamilo/chamilo-lms/commit/37be9ce7243a30259047dd4517c48ff8b21d657a
https//github.com/chamilo/chamilo-lms/commit/4c69b294f927db62092e01b70ac9bd6e32d5b48b

Vendor advisories

support.chamilo.org/projects/chamilo-18/wiki/security_issues#Issue-121-2023-07-05-Critical-impact-High-risk-Unauthenticated-Command-Injection-CVE-2023-3368

Affected products

Product	Affected versions	Fixed in
chamilo chamilo	v < 1.11.20	1.11.20

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.