CVE-2023-45867
CVSS 3.1 Score 6.5 of 10 (medium)
Details
Summary
CVE-2023-45867 is a medium-criticality vulnerability affecting the ILIAS learning management system (2013-09-12 release). An attacker with privileged access, typically holding the tutor role, can exploit a Directory Traversal local file inclusion vulnerability in the ScormAicc module to gain unauthorized access to confidential files. The vulnerability allows the attacker to access files readable by the web server user www-data, potentially including sensitive configuration files and documents located outside the documentRoot. The attacker manipulates the file parameter in a URL to insert directory traversal sequences, enabling them to retrieve files such as /etc/passwd, posing a significant risk to system security and confidentiality. This vulnerability is remotely exploitable over the internet.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions