CVE-2024-30616: High severity chamilo lms vulnerability

Published Nov 4, 2024

Updated

Chamilo LMS 1.11.26 is vulnerable to Incorrect Access Control via main/auth/profile. Non-admin users can manipulate sensitive profiles information, posing a significant risk to data integrity.

Affected Software

2 affected components

Chamilo LMS

Chamilo Chamilo LMS=1.11.26

Remediation

Patch Available

https://github.com/chamilo/chamilo-lms/commit/a1a1e4df70dc65ae4fc7857135f4d3ee185548e7

Event History

Nov 4, 2024

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·07:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-30616?

CVE-2024-30616 is classified as a significant risk due to incorrect access control, allowing unauthorized manipulation of sensitive user profile information.

How do I fix CVE-2024-30616?

To fix CVE-2024-30616, ensure that proper access control mechanisms are implemented for the main/auth/profile endpoint.

Who is affected by CVE-2024-30616?

CVE-2024-30616 affects users of Chamilo LMS version 1.11.26 who do not have admin privileges.

What type of vulnerability is CVE-2024-30616?

CVE-2024-30616 is an access control vulnerability that allows unauthorized users to access sensitive information.

Can CVE-2024-30616 lead to data breaches?

Yes, CVE-2024-30616 can lead to data breaches as non-admin users can manipulate sensitive profile information, jeopardizing data integrity.