Home / Vulnerability Intelligence / CVE-2024-50337

CVE-2024-50337 - Vulnerability Analysis

MediumCVSS: 5.3

Last Updated: March 3, 2026

Chamilo - Server Side Request Forgery

Published: March 2, 2026Updated: March 3, 2026PoC AvailableRemote Exploitable

Overview

Chamilo < 1.11.28 contains a server side request forgery caused by OpenId function allowing requests to arbitrary URLs on server's behalf, letting unauthenticated attackers perform blind SSRF, exploit requires no special privileges.

Severity & Score

Severity: Medium

CVSS Score: 5.3

Impact

Unauthenticated attackers can make the server send arbitrary requests, potentially accessing internal resources or causing other SSRF impacts.

Mitigation

Update to version 1.11.28 or later.

References

https://github.com/chamilo/chamilo-lms/commit/43a9bd1fb8b3f57e7935a6a6bc48975e2063b01b
https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.28
https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-rp2w-g734-jf8h

Related Resources

Vulnerability Intelligence Dashboard
Credential Scanner

Details

CVE ID: CVE-2024-50337
Severity: Medium
CVSS Score: 5.3
Type: server_side_request_forgery
Status: confirmed

CWE

CWE-918

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N