CVE-2024-28198 - CVE House
Back to Database
Status published Medium CVE-2024-28198

XML external entity (XXE) injection in OpenOLAT

Vulnerability Description

OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication. By manually manipulating http requests when using the draw.io integration it is possible to read arbitrary files as the configured system user and SSRF. The problem is fixed in version 18.1.6 and 18.2.2. It is advised to upgrade to the latest version of 18.1.x or 18.2.x. Users unable to upgrade may work around this issue by disabling the Draw.io module or the entire REST API which will secure the system.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-28198

Credits & Attribution

No credits recorded in the NVD database.

References

More from OpenOLAT

View All →
CVE-2021-41242
Path Traversal in some REST methods leading to file upload to arbitrary places
High 8.1
CVE-2021-41152
Path Traversal in Folder Component Leading to Local File Inclusion
High 7.7
CVE-2021-39181
Unsafe Deserialization of User Data Using XStream
High 8.8
CVE-2021-39180
Path Traversal in Archive Handling Leading to Code Execution
High 8.1

Affected Vendor

Affected Software

OpenOLAT
Vulnerable Versions:
< 18.1.6

Timeline

Official Publish: March 11th, 2024
Last Modified: August 2nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L

Weaknesses (CWE)

CWE-611

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1005 Data from Local System
Collection
T1040 Network Sniffing
Collection
T1105 Ingress Tool Transfer
Command and Control
T1499 Endpoint Denial of Service
Impact