CVE-2018-1999019: Code Injection

Published Jul 23, 2018

Updated

Chamilo LMS version 11.x contains an Unserialization vulnerability in the "hash" GET parameter for the api endpoint located at /webservices/api/v2.php that can result in Unauthenticated remote code execution. This attack appear to be exploitable via a simple GET request to the api endpoint. This vulnerability appears to have been fixed in After commit 0de84700648f098c1fbf6b807dee28ec640efe62.

Affected Software

20 affected components

Chamilo Chamilo LMS=1.11.0

Chamilo Chamilo LMS=1.11.0-alpha2

Chamilo Chamilo LMS=1.11.0-beta1

Chamilo Chamilo LMS=1.11.0-beta2

Chamilo Chamilo LMS=1.11.0-beta3

Chamilo Chamilo LMS=1.11.0-beta4

Chamilo Chamilo LMS=1.11.0-beta5

Chamilo Chamilo LMS=1.11.0-beta6

Chamilo Chamilo LMS=1.11.0-beta7

Chamilo Chamilo LMS=1.11.0-rc1

Chamilo Chamilo LMS=1.11.2

Chamilo Chamilo LMS=1.11.4

Chamilo Chamilo LMS=1.11.4-alpha1

Chamilo Chamilo LMS=1.11.4-alpha2

Chamilo Chamilo LMS=1.11.4-beta1

Chamilo Chamilo LMS=1.11.4-rc1

Chamilo Chamilo LMS=1.11.6

Chamilo Chamilo LMS=1.11.6-alpha1

Chamilo Chamilo LMS=1.11.8

Chamilo Chamilo LMS=1.11.8-rc1

Remediation

Patch Available

https://github.com/chamilo/chamilo-lms/commit/0de84700648f098c1fbf6b807dee28ec640efe62

Event History

Jul 23, 2018

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Frequently Asked Questions

What is CVE-2018-1999019?

CVE-2018-1999019 is a vulnerability in Chamilo LMS version 11.x that allows unauthenticated remote code execution.

What is the severity of CVE-2018-1999019?

CVE-2018-1999019 has a severity level of critical with a CVSS score of 9.8.

How does CVE-2018-1999019 affect Chamilo LMS?

CVE-2018-1999019 affects Chamilo LMS version 11.x, specifically the 'hash' GET parameter for the API endpoint located at /webservices/api/v2.php.

How can CVE-2018-1999019 be exploited?

CVE-2018-1999019 can be exploited through a simple GET request to the API endpoint.

Is there a fix for CVE-2018-1999019?

Yes, a fix for CVE-2018-1999019 is available. Update Chamilo LMS to a version that includes the fix.