CVE-2023-4220 is an unrestricted file upload vulnerability in Chamilo LMS versions up to 1.11.24, specifically within the big file upload functionality. This flaw allows unauthenticated attackers to upload web shells, leading to stored cross-site scripting (XSS) and remote code execution (RCE). Rated as MEDIUM severity with a CVSS score of 6.1, it presents a low-complexity attack vector that can be exploited remotely without authentication, potentially impacting confidentiality and integrity. While not currently on the KEV catalog, exploit modules are publicly available in Metasploit and Nuclei, and an ExploitDB entry exists, indicating a high potential for exploitation despite a lack of broader community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 0, <= 1.11.24CPE match | cpe:2.3:a:chamilo:chamilo:*:*:*:*:*:*:*:* | ||
<= 1.11.24CPE matchmatch criteria | cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.