CVE-2018-1999019

Chamilo LMS version 11.x contains an Unserialization vulnerability in the "hash" GET parameter for the api endpoint located at /webservices/api/v2.php that can result in Unauthenticated remote code execution. This attack appear to be exploitable via a simple GET request to the api endpoint. This vulnerability appears to have been fixed in After commit 0de84700648f098c1fbf6b807dee28ec640efe62.

Link	Resource
https://ibb.co/jBxe6y	Mailing List Third Party Advisory
https://github.com/chamilo/chamilo-lms/commit/0de84700648f098c1fbf6b807dee28ec640efe62	Patch Third Party Advisory

Configuration 1

cpe:2.3:a:chamilo:chamilo_lms:1.11.8:-:*:*:*:*:*:* cpe:2.3:a:chamilo:chamilo_lms:1.11.0:-:*:*:*:*:*:* cpe:2.3:a:chamilo:chamilo_lms:1.11.0:alpha2:*:*:*:*:*:* cpe:2.3:a:chamilo:chamilo_lms:1.11.0:beta1:*:*:*:*:*:* cpe:2.3:a:chamilo:chamilo_lms:1.11.0:beta2:*:*:*:*:*:* cpe:2.3:a:chamilo:chamilo_lms:1.11.0:beta3:*:*:*:*:*:* cpe:2.3:a:chamilo:chamilo_lms:1.11.0:beta4:*:*:*:*:*:* cpe:2.3:a:chamilo:chamilo_lms:1.11.0:beta5:*:*:*:*:*:* cpe:2.3:a:chamilo:chamilo_lms:1.11.0:beta6:*:*:*:*:*:* cpe:2.3:a:chamilo:chamilo_lms:1.11.0:beta7:*:*:*:*:*:* cpe:2.3:a:chamilo:chamilo_lms:1.11.0:rc1:*:*:*:*:*:* cpe:2.3:a:chamilo:chamilo_lms:1.11.2:*:*:*:*:*:*:* cpe:2.3:a:chamilo:chamilo_lms:1.11.4:-:*:*:*:*:*:* cpe:2.3:a:chamilo:chamilo_lms:1.11.4:alpha1:*:*:*:*:*:* cpe:2.3:a:chamilo:chamilo_lms:1.11.4:alpha2:*:*:*:*:*:* cpe:2.3:a:chamilo:chamilo_lms:1.11.4:beta1:*:*:*:*:*:* cpe:2.3:a:chamilo:chamilo_lms:1.11.4:rc1:*:*:*:*:*:* cpe:2.3:a:chamilo:chamilo_lms:1.11.6:-:*:*:*:*:*:* cpe:2.3:a:chamilo:chamilo_lms:1.11.6:alpha1:*:*:*:*:*:* cpe:2.3:a:chamilo:chamilo_lms:1.11.8:rc1:*:*:*:*:*:*

---

Published : 2018-07-23 03:29

Updated : 2019-09-17 05:07

---

NVD link : CVE-2018-1999019

Mitre link : CVE-2018-1999019

No products.

CWE-94