CVE-2024-30617: CSRF

Published Nov 4, 2024

Updated

A Cross-Site Request Forgery (CSRF) vulnerability in Chamilo LMS 1.11.26 "/main/social/home.php," allows attackers to initiate a request that posts a fake post onto the user's social wall without their consent or knowledge.

Affected Software

2 affected components

Chamilo LMS

Chamilo Chamilo LMS=1.11.26

Remediation

Patch Available

https://github.com/chamilo/chamilo-lms/commit/7a0e10cccc92eadae9403925f995b0a8d2d1305e

Event History

Nov 4, 2024

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·07:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-30617?

The severity of CVE-2024-30617 is classified as medium due to its potential to allow unauthorized actions on behalf of users.

How do I fix CVE-2024-30617?

To fix CVE-2024-30617, update Chamilo LMS to the latest version that addresses the CSRF vulnerability.

What impact does CVE-2024-30617 have on users of Chamilo LMS?

CVE-2024-30617 can allow attackers to post unauthorized content on users' social walls without their consent.

Is CVE-2024-30617 present in versions of Chamilo LMS other than 1.11.26?

CVE-2024-30617 specifically affects Chamilo LMS version 1.11.26.

How can an attacker exploit CVE-2024-30617?

An attacker can exploit CVE-2024-30617 by crafting a malicious request that takes advantage of the CSRF vulnerability to make unauthorized posts.