CVE-2025-11346

Katalog CVE

CVSS 9.8 · Critical EPSS 0,44%

Kerentanan Improper Input Validation pada ilias. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A vulnerability has been found in ILIAS up to 8.23/9.13/10.1. This affects the function unserialize of the component Base64 Decoding Handler. Such manipulation of the argument f_settings leads to deserialization. It is possible to launch the attack remotely. Upgrading to version 8.24, 9.14 and 10.2 is able to mitigate this issue. It is advisable to upgrade the affected component.

Rincian

Terbit di NVD

6 Oktober 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

0,44% peluang dieksploitasi; lebih tinggi dari 36,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://vuldb.com/?id.327231 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.664892 advisory pihak ketiga · vdb entry
• https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-2113 advisory pihak ketiga
• https://vuldb.com/?ctiid.327231 permissions required · vdb entry
• https://srlabs.de/blog/breaking-ilias-part-2-three-to-rce