CVEvulnerability

CVE-2024-50337

5.3 MEDIUM Published 2026-03-02 Modified 2026-06-17 Official page ↗

Status: Analyzed
Published: 2026-03-02
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses: CWE-918

Description

Chamilo is a learning management system. Prior to version 1.11.28, the OpenId function allows anyone to send requests to any URL on server's behalf, which results in unauthenticated blind SSRF. This issue has been patched in version 1.11.28.

Affected configurations

• chamilo chamilo lms (< 1.11.28)

Weakness · CWE (1)

CWE-918 Server-Side Request Forgery weakness

References

https://github.com/chamilo/chamilo-lms/commit/43a9bd1fb8b3f57e7935a6a6bc48975e2063b01b Patch
https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.28 Product, Release Notes
https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-rp2w-g734-jf8h Exploit, Vendor Advisory

CVE-2024-50337

Description

Affected configurations

Related

Weakness · CWE (1)

References