A user without privileges in Chamilo LMS 1.11.14 can send an invitation message to another user, e.g., the administrator, through main/social/search.php, main/inc/lib/social.lib.php and steal cookies or execute arbitrary code on the administration side via a stored XSS vulnerability via social network the send invitation feature.
References
Link | Resource |
---|---|
https://github.com/chamilo/chamilo-lms/commit/de43a77049771cce08ea7234c5c1510b5af65bc8 | Patch Third Party Advisory |
https://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chamilo-lms-1.11.14-xss-vulnerabilities | Exploit Third Party Advisory |
Configurations
Information
Published : 2021-08-10 13:15
Updated : 2021-08-19 10:05
NVD link : CVE-2021-37391
Mitre link : CVE-2021-37391
JSON object : View
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Products Affected
chamilo
- chamilo_lms