CVE-2024-47886 - Vulnerability Analysis

Overview

Chamilo 1.11.12 to 1.11.26 contains a remote code execution caused by post-authentication phar unserialize in the virtualization plugin vchamilo, letting administrators execute arbitrary code on the server, exploit requires administrator privileges.

Severity & Score

Impact

Administrators can execute arbitrary code on the server, potentially leading to full server compromise.

Mitigation

Upgrade to version 1.11.26.

References

• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.28
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-c4fc-vjm9-9mvc

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner