CVE-2025-52998

Katalog CVE

CVSS 9.8 · Critical EPSS 0,38%

Kerentanan Deserialization of Untrusted Data pada chamilo lms. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Chamilo is a learning management system. Prior to version 1.11.30, in the application, deserialization of data is performed, the data can be spoofed. An attacker can create objects of arbitrary classes, as well as fully control their properties, and thus modify the logic of the web application's operation. This issue has been patched in version 1.11.30.

Rincian

Terbit di NVD

2 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

0,38% peluang dieksploitasi; lebih tinggi dari 30,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-6mwg-2mw5-rx5v patch · advisory vendor
• https://github.com/chamilo/chamilo-lms/commit/ba7e15d8cfefcd451de939e98d461b17e72eb627 patch
• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.30 product · release notes