Back to Database
Status published
Critical
CVE-2023-3533
Chamilo LMS Unauthenticated Remote Code Execution via Arbitrary File Write
Vulnerability Description
Path traversal in file upload functionality in `/main/webservices/additional_webservices.php` in Chamilo LMS <= v1.11.20 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via arbitrary file write.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-3533
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Ngo Wei Lin (@Creastery) of STAR Labs SG Pte. Ltd. (@starlabs_sg)
References
- https://support.chamilo.org/projects/chamilo-18/wiki/security_issues#Issue-124-2023-07-13-Critical-impact-High-risk-Unauthenticated-Arbitrary-File-Write-RCE-CVE-2023-3533
- https://starlabs.sg/advisories/23/23-3533/
- https://github.com/chamilo/chamilo-lms/commit/37be9ce7243a30259047dd4517c48ff8b21d657a
More from Chamilo
View All →CVE-2023-4226
Chamilo LMS File Upload Functionality Remote Code Execution
High
8.8
CVE-2023-4225
Chamilo LMS File Upload Functionality Remote Code Execution
High
8.8
CVE-2023-4224
Chamilo LMS File Upload Functionality Remote Code Execution
High
8.8
CVE-2023-4223
Chamilo LMS File Upload Functionality Remote Code Execution
High
8.8
CVE-2023-4222
Chamilo LMS Learning Path PPT2LP Command Injection Vulnerability
High
7.2
Affected Vendor
Chamilo
View all reports →Affected Software
Chamilo
Vulnerable Versions:
0
Timeline
Official Publish:
November 28th, 2023
Last Modified:
August 2nd, 2024
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H