Description (CNA)
ILIAS Learning Management System 4.3 contains a server-side request forgery vulnerability that allows attackers to read local files through portfolio PDF export functionality. Attackers can inject a script that uses XMLHttpRequest to retrieve local file contents when the portfolio is exported to PDF.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| ilias.de / ILIAS Learning Management System | affected 4.3-5.1 |
CWE
CWE-918
References
- https://www.exploit-db.com/exploits/49148
- https://www.ilias.de/
- https://github.com/ILIAS-eLearning/ILIAS
- https://www.vulncheck.com/advisories/ilias-learning-management-system-ssrf
ADP enrichment
No English description supplied.
No references supplied.