Chamilo Learning Management System: Malicious Code Injection Risk

Summary

A security flaw in older versions of the Chamilo learning management system allows an attacker to inject malicious code into the system, potentially stealing sensitive user information and taking over higher-privileged user accounts. This issue has been fixed in version 1.11.34, so update your system to the latest version to protect your users. If you're still using an older version, consider updating as soon as possible to prevent potential security risks.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
chamilo	chamilo_lms	<= 1.11.34	–

Original title

Chamilo is a learning management system. Prior to version 1.11.34, there is a stored cross-site scripting (XSS) vulnerability. By injecting malicious JavaScript into the course learning path Settin...

Original description

Chamilo is a learning management system. Prior to version 1.11.34, there is a stored cross-site scripting (XSS) vulnerability. By injecting malicious JavaScript into the course learning path Settings field, an attacker with a low-privileged account (e.g., trainer) can execute arbitrary JavaScript code in the context of any other user viewing the course information page, including administrators. This allows an attacker to exfiltrate sensitive session cookies or tokens, resulting in account takeover (ATO) of higher-privileged users. This issue has been patched in version 1.11.34.

nvd CVSS3.1 9.0

Vulnerability type

CWE-79 Cross-site Scripting (XSS)