CVE-2023-34960

A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API call with a crafted PowerPoint name.
Configurations

Configuration 1 (hide)

cpe:2.3:a:chamilo:chamilo:*:*:*:*:*:*:*:*

History

04 Aug 2023, 16:05

Type Values Removed Values Added
References (MISC) http://chamilo.com - (MISC) http://chamilo.com - Product
References (MISC) https://support.chamilo.org/projects/1/wiki/Security_issues#Issue-112-2023-04-20-Critical-impact-High-risk-Remote-Code-Execution - (MISC) https://support.chamilo.org/projects/1/wiki/Security_issues#Issue-112-2023-04-20-Critical-impact-High-risk-Remote-Code-Execution - Issue Tracking, Vendor Advisory
CWE CWE-77
CPE cpe:2.3:a:chamilo:chamilo:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 9.8

01 Aug 2023, 02:15

Type Values Removed Values Added
New CVE

Information

Published : 2023-08-01 02:15

Updated : 2024-02-05 00:01


NVD link : CVE-2023-34960

Mitre link : CVE-2023-34960

CVE.ORG link : CVE-2023-34960


JSON object : View

Products Affected

chamilo

  • chamilo
CWE
CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')