CVE-2023-4221

High

Description

Command injection in `main/lp/openoffice_presentation.class.php` in Chamilo LMS <= v1.11.24 allows users permitted to upload Learning Paths to obtain remote code execution via improper neutralisation of special characters.

SeverityHigh

CVSS7.2

Exploit probability—

Product

Chamilo Lms

PublishedNov 28, 2023

First seenNov 28, 2023

Weakness typeCWE-78OS command injection

How to fix

Patches

github.com/chamilo/chamilo-lms/commit/ed72914608d2a07ee2eb587c1a654480d08201db
github.com/chamilo/chamilo-lms/commit/841a07396fed0ef27c5db13a1b700eac02754fc7

Vendor advisories

support.chamilo.org/projects/chamilo-18/wiki/security_issues#Issue-128-2023-09-04-Critical-impact-Moderate-risk-Authenticated-users-may-gain-unauthenticated-RCE-CVE-2023-4221CVE-2023-4222

Affected products

Product	Affected versions	Fixed in
chamilo chamilo_lms	v ≤ 1.11.24	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.