CVE-2021-35413
First published: Fri Dec 03 2021(Updated: )
A remote code execution (RCE) vulnerability in course_intro_pdf_import.php of Chamilo LMS v1.11.x allows authenticated attackers to execute arbitrary code via a crafted .htaccess file.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Chamilo Chamilo Lms | >=1.11.0<=1.11.16 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/andrejspuler/writeups/tree/main/chamilo-lms#authenticated-remote-code-execution-in-import-file
- https://github.com/chamilo/chamilo-lms/commit/2e5c004b57d551678a1815500ef91524ba7bb757
- https://github.com/chamilo/chamilo-lms/commit/905a21037ebc9bc5369f0fb380177cb56f496f5c
- https://support.chamilo.org/projects/1/wiki/Security_issues#Issue-66-2021-05-21-High-impact-very-low-risk-Authenticated-RCE-in-accessory-script
Frequently Asked Questions
What is CVE-2021-35413?
CVE-2021-35413 is a remote code execution vulnerability in course_intro_pdf_import.php of Chamilo LMS v1.11.x that allows authenticated attackers to execute arbitrary code via a crafted .htaccess file.
How can an attacker exploit CVE-2021-35413?
To exploit CVE-2021-35413, an attacker needs to be authenticated and can execute arbitrary code by using a crafted .htaccess file.
What is the severity of CVE-2021-35413?
CVE-2021-35413 has a high severity rating of 8.8 (out of 10).
Which version of Chamilo LMS is affected by CVE-2021-35413?
CVE-2021-35413 affects Chamilo LMS v1.11.x versions from 1.11.0 to 1.11.16.
Is there a fix or patch available for CVE-2021-35413?
Yes, a fix for CVE-2021-35413 is available. It is recommended to update Chamilo LMS to a version where the vulnerability has been patched.
- collector/nvd-index
- agent/references
- agent/severity
- agent/author
- agent/type
- agent/event
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/softwarecombine
- agent/last-modified-date
- agent/remedy
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/chamilo
- canonical/chamilo chamilo lms
- version/chamilo chamilo lms/1.11.0
- version/chamilo chamilo lms/1.11.16