Description

A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API call with a crafted PowerPoint name.

Remediation

References

CVE-2023-34960

Related Vulnerabilities

WordPress Plugin HTML5 MP3 Player with Playlist Free Information Disclosure (2.6)

Drupal Core 4.6.x Multiple Vulnerabilities (4.6.0 - 4.6.3)

Joomla! Core 3.x.x Cross-Site Scripting (3.0.0 - 3.9.11)

Ruby on Rails CVE-2024-28103 Vulnerability (CVE-2024-28103)

Oracle Application Server CVE-2008-4017 Vulnerability (CVE-2008-4017)

Severity

Critical

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities CWE-138 CVE-2023-34960