Back to Database
Status published
Medium
CVE-2020-23128
Chamilo LMS 1.11.10 does not properly manage privileges which could...
Vulnerability Description
Chamilo LMS 1.11.10 does not properly manage privileges which could allow a user with Sessions administrator privilege to create a new user then use the edit user function to change this new user to administrator privilege.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-23128
Credits & Attribution
No credits recorded in the NVD database.
References
More from chamilo
View All →CVE-2025-66447
Chamilo LMS has validation-less redirect on login page
Unknown
0
CVE-2025-59544
Chamilo: Unauthorized access to update category of any user
Medium
6.9
CVE-2025-59543
Chamilo: Account Takeover via Stored XSS in Course Description
Critical
9.1
CVE-2025-59542
Chamilo: Account Takeover via Stored XSS in Course Learning Paths
Critical
9.1
CVE-2025-59541
Chamilo: CSRF Vulnerability in Project Deletion
High
8.1
Affected Vendor
chamilo
View all reports →Affected Software
chamilo lms
Vulnerable Versions:
1.11.10
Timeline
Official Publish:
May 5th, 2021
Last Modified:
August 4th, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.