Security-Blog
ILIAS 9.24
Following 16 security issues have been resolved:
0047077: File Services: Prohibited file suffixes bypassable
0048028: Authenticated RCE via Test import
0048072: Authenticated RCE via CmiXapi
0048213: Stored XSS in the news
0048292: Unauthenticated test-question rendering
0048298: Fix forum attachment download processes ignored forum binding
0048313: Unauthenticated user and role enumeration via calendar
0048359: Close RCE in ImageMap Question by Removing Unnecessary Code
0048362: Broken access control in MyStaff
0048365: Fix file deletion through uncaught file traversal opportunity in SingleChoice, MultipleChoice, KPrim, Matching, and Ordering Questions
0048366: Stored XSS in SCORM tracking reports
0048402: Prevent Accessing Anonymous Test Run by Providing Active Id Only
0048413: RCE via questionpool import
0048414: RCE in ImageMapQuestion
0048447: Anonymous user enumeration via Survey
0048453: File: Anonymous users could download file objects without permission when the public area was enabled.
Affected Version(s) | 9.23, 10.11, 11.4 |
Fixed Version(s) | 9.24, 10.12, 11.5, 12.0 Alpha |
CVSS Score 4.0 | 6.3 |
Reported By | Martin-Luther-Universität Halle-Wittenberg |
Affected Version(s) | 9.23, 10.11, 11.4 |
Fixed Version(s) | 9.24, 10.12, 11.5, 12.0 Alpha |
CVSS Score 4.0 | 9.3 |
Reported By | André Schweigert (FAU|ILIAS) |
Affected Version(s) | 9.23, 10.11, 11.4 |
Fixed Version(s) | 9.24, 10.12, 11.5, 12.0 Alpha |
CVSS Score 4.0 | 8.7 |
Reported By | André Schweigert ( FAU | ILIAS ) |
Affected Version(s) | 9.23, 10.11, 11.4 |
Fixed Version(s) | 9.24, 10.12, 11.5, 12.0 Alpha |
CVSS Score 4.0 | 7.0 |
Reported By | André Schweigert ( FAU | ILIAS ) |
Affected Version(s) | 9.23, 10.11, 11.4 |
Fixed Version(s) | 9.24, 10.12, 11.5, 12.0 Alpha |
CVSS Score 4.0 | 6.9 |
Reported By | André Schweigert (FAU|ILIAS) |
Affected Version(s) | 9.23, 10.11, 11.4 |
Fixed Version(s) | 9.24, 10.12, 11.5, 12.0 Alpha |
CVSS Score 4.0 | 7.1 |
Reported By |
Affected Version(s) | 9.23, 10.11, 11.4 |
Fixed Version(s) | 9.24, 10.12, 11.5, 12.0 Alpha |
CVSS Score 4.0 | 6.9 |
Reported By | André Schweigert ( FAU | ILIAS ) |
Affected Version(s) | 9.23, 10.11, 11.4 |
Fixed Version(s) | 9.24, 10.12, 11.5, 12.0 Alpha |
CVSS Score 4.0 | 9.0 |
Reported By | André Schweigert ( FAU | ILIAS ) |
Affected Version(s) | 9.23, 10.11, 11.4 |
Fixed Version(s) | 9.24, 10.12, 11.5, 12.0 Alpha |
CVSS Score 4.0 | 7.1 |
Reported By | Peter Reichartz |
Affected Version(s) | 9.23, 10.11, 11.4 |
Fixed Version(s) | 9.24, 10.12, 11.5, 12.0 Alpha |
CVSS Score 4.0 | 8.5 |
Reported By | André Schweigert (SchweigertIT) |
Affected Version(s) | 9.23, 10.11, 11.4 |
Fixed Version(s) | 9.24, 10.12, 11.5, 12.0 Alpha |
CVSS Score 4.0 | 7.4 |
Reported By | André Schweigert (SchweigertIT) |
Affected Version(s) | 9.23, 10.11, 11.4 |
Fixed Version(s) | 9.24, 10.12, 11.5, 12.0 Alpha |
CVSS Score 4.0 | 8.3 |
Reported By |
Affected Version(s) | 9.23, 10.11, 11.4 |
Fixed Version(s) | 9.24, 10.12, 11.5, 12.0 Alpha |
CVSS Score 4.0 | 8.7 |
Reported By | André Schweigert (SchweigertIT) |
Affected Version(s) | 9.23, 10.11, 11.4 |
Fixed Version(s) | 9.24, 10.12, 11.5, 12.0 Alpha |
CVSS Score 4.0 | 8.7 |
Reported By | André Schweigert (SchweigertIT) |
Affected Version(s) | 9.23, 10.11, 11.4 |
Fixed Version(s) | 9.24, 10.12, 11.5, 12.0 Alpha |
CVSS Score 4.0 | 8.7 |
Reported By | André Schweigert (FAU|ILIAS) |
Affected Version(s) | 9.23, 10.11, 11.4 |
Fixed Version(s) | 9.24, 10.12, 11.5, 12.0 Alpha |
CVSS Score 4.0 | 8.2 |
Reported By | Isira Adithya (@isira_adithya, https://github.com/isira-adithya) |