CVE-2023-45867

ILIAS (2013-09-12 release) contains a medium-criticality Directory Traversal local file inclusion vulnerability in the ScormAicc module. An attacker with a privileged account, typically holding the tutor role, can exploit this to gain unauthorized access to and potentially retrieve confidential files stored on the web server. The attacker can access files that are readable by the web server user www-data; this may include sensitive configuration files and documents located outside the documentRoot. The vulnerability is exploited by an attacker who manipulates the file parameter in a URL, inserting directory traversal sequences in order to access unauthorized files. This manipulation allows the attacker to retrieve sensitive files, such as /etc/passwd, potentially compromising the system's security. This issue poses a significant risk to confidentiality and is remotely exploitable over the internet.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://rehmeinfosec.de	Third Party Advisory
https://rehmeinfosec.de/labor/cve-2023-45867	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:ilias:ilias:7.25:*:*:*:*:*:*:*

History

12 Sep 2024, 15:35

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-10-26 15:15

Updated : 2024-09-12 15:35

NVD link : CVE-2023-45867

Mitre link : CVE-2023-45867

CVE.ORG link : CVE-2023-45867

JSON object : View

Products Affected

ilias

ilias

CWE

NVD-CWE-Other CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2023-45867", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2023-10-26T15:15:08.900", "references": [{"url": "https://rehmeinfosec.de", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://rehmeinfosec.de/labor/cve-2023-45867", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "ILIAS (2013-09-12 release) contains a medium-criticality Directory Traversal local file inclusion vulnerability in the ScormAicc module. An attacker with a privileged account, typically holding the tutor role, can exploit this to gain unauthorized access to and potentially retrieve confidential files stored on the web server. The attacker can access files that are readable by the web server user www-data; this may include sensitive configuration files and documents located outside the documentRoot. The vulnerability is exploited by an attacker who manipulates the file parameter in a URL, inserting directory traversal sequences in order to access unauthorized files. This manipulation allows the attacker to retrieve sensitive files, such as /etc/passwd, potentially compromising the system's security. This issue poses a significant risk to confidentiality and is remotely exploitable over the internet."}, {"lang": "es", "value": "ILIAS (versi\u00f3n del 12/09/2013) contiene una vulnerabilidad de inclusi\u00f3n de archivos locales Directory Traversal de gravedad media en el m\u00f3dulo ScormAicc. Un atacante con una cuenta privilegiada, que normalmente desempe\u00f1a el rol de tutor, puede aprovechar esto para obtener acceso no autorizado y potencialmente recuperar archivos confidenciales almacenados en el servidor web. El atacante puede acceder a archivos que el usuario del servidor web www-data puede leer; esto puede incluir archivos de configuraci\u00f3n confidenciales y documentos ubicados fuera de documentRoot. La vulnerabilidad es explotada por un atacante que manipula el par\u00e1metro del archivo en una URL, insertando secuencias de Directory Traversal para acceder a archivos no autorizados. Esta manipulaci\u00f3n permite al atacante recuperar archivos confidenciales, como /etc/passwd, comprometiendo potencialmente la seguridad del sistema. Este problema plantea un riesgo importante para la confidencialidad y se puede explotar de forma remota a trav\u00e9s de Internet."}], "lastModified": "2024-09-12T15:35:41.190", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ilias:ilias:7.25:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BF8E6CB0-A19A-4B18-90D8-352676E169E9"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}