CVE-2018-1999019

Published: Jul 23, 2018Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Chamilo LMS version 11.x contains an Unserialization vulnerability in the "hash" GET parameter for the api endpoint located at /webservices/api/v2.php that can result in Unauthenticated remote code execution. This attack appear to be exploitable via a simple GET request to the api endpoint. This vulnerability appears to have been fixed in After commit 0de84700648f098c1fbf6b807dee28ec640efe62.

Affected (20)

Products: Chamilo: Chamilo Lms

Chamilo

1 product

Chamilo Lms

Configuration A

20 vulnerable

Vulnerable Software	Affected Versions
Chamilo Chamilo Lms	Version 1.11.0
Chamilo Chamilo Lms	Version 1.11.0 alpha2
Chamilo Chamilo Lms	Version 1.11.0 beta1
Chamilo Chamilo Lms	Version 1.11.0 beta2
Chamilo Chamilo Lms	Version 1.11.0 beta3
Chamilo Chamilo Lms	Version 1.11.0 beta4
Chamilo Chamilo Lms	Version 1.11.0 beta5
Chamilo Chamilo Lms	Version 1.11.0 beta6
Chamilo Chamilo Lms	Version 1.11.0 beta7
Chamilo Chamilo Lms	Version 1.11.0 rc1
Chamilo Chamilo Lms	Version 1.11.2
Chamilo Chamilo Lms	Version 1.11.4
Chamilo Chamilo Lms	Version 1.11.4 alpha1
Chamilo Chamilo Lms	Version 1.11.4 alpha2
Chamilo Chamilo Lms	Version 1.11.4 beta1
Chamilo Chamilo Lms	Version 1.11.4 rc1
Chamilo Chamilo Lms	Version 1.11.6
Chamilo Chamilo Lms	Version 1.11.6 alpha1
Chamilo Chamilo Lms	Version 1.11.8
Chamilo Chamilo Lms	Version 1.11.8 rc1