Description
ILIAS versions before 9.23, 10.11, and 11.4 contain an authorization bypass vulnerability in ilObjGroupGUI where saveMapSettingsObject() and updateGroupTypeObject() perform state-changing operations without write permission checks. Authenticated users with only read access to a group can craft POST requests to modify group map settings and didactic template assignments, changing group modes and permissions for all members.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
ILIAS-eLearning e.V. ILIAS
Default version status: unaffected
9.0 to < 9.23affected10.0 to < 10.11affected11.0 to < 11.4affected
pkg:github/ILIAS-eLearning/ILIASReferences
- https://docu.ilias.de/ilias.php?baseClass=ilrepositorygui&cmdNode=wy:ll:6t&cmdClass=ilBlogPostingGUI&cmd=previewFullscreen&ref_id=15821&blpg=942 ↗
- https://docu.ilias.de/ilias.php?baseClass=ilrepositorygui&cmdNode=wy:ll:6t&cmdClass=ilBlogPostingGUI&cmd=previewFullscreen&ref_id=15821&blpg=941 ↗
- https://docu.ilias.de/ilias.php?baseClass=ilrepositorygui&cmdNode=wy:ll:6t&cmdClass=ilBlogPostingGUI&cmd=previewFullscreen&ref_id=15821&blpg=940 ↗
- https://github.com/ILIAS-eLearning/ILIAS/commit/16bca712847f83440fa051cdbb15b38296357c79 ↗
- https://github.com/ILIAS-eLearning/ILIAS/blob/v11.3/components/ILIAS/Group/classes/class.ilObjGroupGUI.php#L560-L569 ↗
- https://github.com/ILIAS-eLearning/ILIAS/blob/v11.3/components/ILIAS/Group/classes/class.ilObjGroupGUI.php#L830-L858 ↗
- https://github.com/ILIAS-eLearning/ILIAS ↗
- https://www.vulncheck.com/advisories/ilias-before-9.23-10.11-and-11.4-missing-authorization-in-group-object-action-methods ↗