CVE-2023-3368criticalexploração observadaCWE-78

CVE-2023-3368: falha crítica em Chamilo

Chamilo LMS Unauthenticated Command Injection

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Chamilo

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

77Vexday Risk Score

Corrija agora. Ela exploração observada pelo VulnCheck e tem exploit funcional público.

ssvc Actcvss 9.8epss 70%
da publicação à arma
Publicada no NVD28 de nov.
VulnCheck+295d
Command injection in `/main/webservices/additional_webservices.php` in Chamilo LMS <= v1.11.20 allows unauthenticated attackers to obtain remote code execution via improper neutralisation of special characters. This is a bypass of CVE-2023-34960.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Chamilo · Chamilo
CVEs relacionadas — Chamilo

No mesmo produto, das mais perigosas para as menos.

CVE-2023-4220HIGHChamilo LMS Unauthenticated Big Upload File Remote Code ExecutionEPSS 76.1%CVE-2023-4222HIGHChamilo LMS Learning Path PPT2LP Command Injection VulnerabilityEPSS 3.5%CVE-2023-4221HIGHChamilo LMS Learning Path PPT2LP Command Injection VulnerabilityEPSS 3.5%CVE-2023-3533CRITICALChamilo LMS Unauthenticated Remote Code Execution via Arbitrary File WriteEPSS 3.5%CVE-2023-4226HIGHChamilo LMS File Upload Functionality Remote Code ExecutionEPSS 2.5%CVE-2023-3545CRITICALChamilo LMS Htaccess File Upload Security BypassEPSS 2.4%