Description
Chamilo LMS 2.0.0 pre-releases from 2.0.0-alpha.1 before 2.0.0-RC.3 contain a missing access control vulnerability in GradebookController that allows unauthenticated users to modify gradebook certificates. Attackers can request the set_default_certificate endpoint with any course id and document id to tamper with certificate configuration for any course.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
chamilo chamilo-lms
Default version status: unaffected
2.0.0-alpha.1 to < 2.0.0-RC.3affected
pkg:github/chamilo/chamilo-lmsReferences
- https://github.com/chamilo/chamilo-lms/issues/7671 ↗
- https://github.com/chamilo/chamilo-lms/commit/2861afd4896ff898a950302f2c00f44726fa6f0a ↗
- https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3 ↗
- https://github.com/chamilo/chamilo-lms/blob/v2.0.0-RC.2/src/CoreBundle/Controller/GradebookController.php#L52-L78 ↗
- https://www.vulncheck.com/advisories/chamilo-lms-2.0.0-alpha.1-before-2.0.0-rc.3-missing-authorization-via-gradebookcontroller ↗