Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.1
CVE-2024-27524: Attackers can steal or alter data in Chamilo LMS via malicious links
CVE-2024-27524 · published 2 years ago
Summary
A security issue in Chamilo LMS version 1.11.26 allows an attacker to create malicious links that can be used to steal or alter sensitive data. This can happen when a user clicks on a link sent by the attacker. To stay safe, update to the latest version of Chamilo LMS or use a web application firewall to block suspicious traffic.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| chamilo | chamilo_lms |
1.11.26 cpe:2.3:a:chamilo:chamilo_lms:1.11.26:-:*:*:*:*:*:* |
Original advisory text
Cross Site Scripting vulnerability in Chamilo LMS v.1.11.26 allows a remote attacker to escalate privileges via a crafted script to the filename parameter of the new_ticket.php component.
Cross Site Scripting vulnerability in Chamilo LMS v.1.11.26 allows a remote attacker to escalate privileges via a crafted script to the filename parameter of the new_ticket.php component.
References
- https://www.less-secure.com/2024/10/chamilo-lms-cve-2024-27524-cve-2024.html URL
- https://github.com/chamilo/chamilo-lms/commit/53275c152275958b33a1f87a21843daa52... Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27524... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-27524 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published1 Nov 2024
Updated4 Nov 2026
First seen7 Mar 2026
Track software like this
Free during beta