CVE-2024-47886

Katalog CVE

CVSS 7.2 · High EPSS 0,92%

Kerentanan Deserialization of Untrusted Data pada chamilo lms. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

Chamilo is a learning management system. Chamillo is affected by a post-authentication phar unserialize which leads to a remote code execution (RCE) within versions 1.11.12 to 1.11.26. By abusing multiple supported features from the virtualization plugin vchamilo, the vulnerability allows an administrator to execute arbitrary code on the server. This issue has been patched in version 1.11.26.

Rincian

Terbit di NVD

2 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

0,92% peluang dieksploitasi; lebih tinggi dari 59,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-c4fc-vjm9-9mvc exploit · advisory vendor
• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.28 product · release notes