Description
Chamilo LMS is a learning management system. Prior to 1.11.38, Twig template files (.tpl) under /main/template/default/ are directly accessible without authentication via HTTP GET requests. These templates expose internal application logic, variable names, AJAX endpoint URLs, and admin panel structure. This vulnerability is fixed in 1.11.38.
Remediation
References
Related Vulnerabilities
CakePHP Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-4399)
Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-3731)
WordPress Plugin Parsian Bank Woocommerce Cross-Site Scripting (1.0)
Roundcube Multiple Buffer Overflow Vulnerabilities (CVE-2015-2181)
WordPress Plugin Duplicator-WordPress Migration Cross-Site Scripting (1.2.28)