The workflow-engine of ILIAS before 7.23 and 8 before 8.3 allows remote authenticated users to run arbitrary system commands on the application server as the application user by uploading a workflow definition file with a malicious filename.
References
Configurations
Configuration 1 (hide)
|
History
14 Feb 2024, 00:22
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.2 |
03 Jan 2024, 22:54
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/ILIAS-eLearning/ILIAS/pull/5987 - Patch | |
| References | () https://docu.ilias.de/ilias.php?baseClass=ilrepositorygui&cmdNode=xd:kx:54&cmdClass=ilBlogPostingGUI&cmd=previewFullscreen&ref_id=3439&prvm=fsc&bmn=2023-12&blpg=786 - Vendor Advisory | |
| References | () https://github.com/ILIAS-eLearning/ILIAS/pull/5988 - Patch | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| CPE | cpe:2.3:a:ilias:ilias:*:*:*:*:*:*:*:* | |
| CWE | NVD-CWE-noinfo |
25 Dec 2023, 08:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-12-25 08:15
Updated : 2024-02-14 00:22
NVD link : CVE-2023-36486
Mitre link : CVE-2023-36486
CVE.ORG link : CVE-2023-36486
JSON object : View
Products Affected
ilias
- ilias
CWE