Description
Chamilo LMS from 2.0.0-alpha.4 before 2.0.0-RC.3 contains a missing authorization vulnerability in AiController::openAnswerGrade that allows any authenticated user to obtain AI grading of other students' exam attempts. Attackers can enumerate exeId and questionId values sent to the open_answer_grade endpoint to expose other students' answers through feedback and consume AI quota.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
chamilo chamilo-lms
Default version status: unaffected
2.0.0-alpha.4 to < 2.0.0-RC.3affected
pkg:github/chamilo/chamilo-lmsReferences
- https://github.com/chamilo/chamilo-lms/issues/7671 ↗
- https://github.com/chamilo/chamilo-lms/commit/2861afd4896ff898a950302f2c00f44726fa6f0a ↗
- https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3 ↗
- https://github.com/chamilo/chamilo-lms/blob/v2.0.0-RC.2/src/CoreBundle/Controller/AiController.php#L525-L703 ↗
- https://www.vulncheck.com/advisories/chamilo-lms-2.0.0-alpha.4-before-2.0.0-rc.3-missing-authorization-via-openanswergrade ↗