Back to Database
Status published
Medium
CVE-2018-20328
Chamilo LMS version 1.11.8 contains XSS in main/social/group_view.php in the...
Vulnerability Description
Chamilo LMS version 1.11.8 contains XSS in main/social/group_view.php in the social groups tool, allowing authenticated users to affect other users, under specific conditions of permissions granted by administrators. This is considered "low risk" due to the nature of the feature it exploits.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-20328
Credits & Attribution
No credits recorded in the NVD database.
References
More from chamilo
View All →CVE-2025-66447
Chamilo LMS has validation-less redirect on login page
Unknown
0
CVE-2025-59544
Chamilo: Unauthorized access to update category of any user
Medium
6.9
CVE-2025-59543
Chamilo: Account Takeover via Stored XSS in Course Description
Critical
9.1
CVE-2025-59542
Chamilo: Account Takeover via Stored XSS in Course Learning Paths
Critical
9.1
CVE-2025-59541
Chamilo: CSRF Vulnerability in Project Deletion
High
8.1
Affected Vendor
chamilo
View all reports →Affected Software
chamilo lms
Vulnerable Versions:
1.11.8
Timeline
Official Publish:
December 21st, 2018
Last Modified:
August 5th, 2024
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.