CVE-2025-11345

Katalog CVE

CVSS 9.8 · Critical EPSS 0,36%

Kerentanan Improper Input Validation pada ilias. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A flaw has been found in ILIAS up to 8.23/9.13/10.1. Affected by this issue is the function unserialize of the component Test Import. This manipulation causes deserialization. It is possible to initiate the attack remotely. Upgrading to version 8.24, 9.14 and 10.2 can resolve this issue. Upgrading the affected component is advised.

Rincian

Terbit di NVD

6 Oktober 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 28,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://docu.ilias.de/go/blog/15821/882 release notes · advisory vendor
• https://vuldb.com/?id.327230 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.664891 advisory pihak ketiga · vdb entry
• https://vuldb.com/?ctiid.327230 permissions required · vdb entry
• https://srlabs.de/blog/breaking-ilias-part-2-three-to-rce