CVE-2022-31266: Critical severity ilias vulnerability
Published Jun 29, 2022
·Updated
In ILIAS through 7.10, lack of verification when changing an email address (on the Profile Page) allows remote attackers to take over accounts.
Affected Software
1 affected component
ILIAS ILIAS<=7.10
Event History
Jun 29, 2022
CVE Published
via MITRE·12:46 AM
Data Sourced
via MITRE·12:46 AM
Description
Frequently Asked Questions
1
What is the vulnerability ID of this ILIAS vulnerability?
The vulnerability ID is CVE-2022-31266.
2
What is the severity rating of CVE-2022-31266?
The severity rating of CVE-2022-31266 is 9.8 (critical).
3
How does the vulnerability in ILIAS through 7.10 allow attackers to take over accounts?
The vulnerability allows remote attackers to take over accounts by exploiting the lack of verification when changing an email address on the Profile Page.
4
What software versions are affected by CVE-2022-31266?
All versions up to and including ILIAS 7.10 are affected by CVE-2022-31266.
5
Is there any additional reference material available for CVE-2022-31266?
Yes, you can find additional reference material at the following links: [Medium](https://medium.com/@bcksec/in-ilias-through-7-10-620c0de685ee) and [BCKSEC](https://www.bcksec.com/services/).