Gnaegi

**Name of the Vulnerable Software and Affected Versions** OpenOlat versions prior to 18.1.6 OpenOlat versions prior to 18.2.2 **Description** OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication. By manually manipulating http requests when using the draw.io integration, it is possible to read arbitrary files as the configured system user and perform Server-Side Request Forgery (SSRF). **Recommendations** For versions prior to 18.1.6, upgrade to the latest version of 18.1.x. For versions prior to 18.2.2, upgrade to the latest version of 18.2.x. As a temporary workaround, consider disabling the Draw.io module or the entire REST API to secure the system.

**Name of the Vulnerable Software and Affected Versions** OpenOlat versions prior to 15.5.12 and 16.0.5 **Description** A path traversal issue exists in OpenOlat, allowing an attacker to create directory structures and write files anywhere on the target system by providing a filename with a relative path as a parameter in some REST methods. This could be used to write files in the web root folder or outside, depending on system configuration and application server user permissions. The attack requires an OpenOlat user account, an enabled REST API, and rights to call vulnerable REST calls. **Recommendations** For versions prior to 15.5.12, update to version 15.5.12 or later. For versions prior to 16.0.5, update to version 16.0.5 or later. As a temporary workaround, consider disabling the REST module or limiting its access via firewall or web-server rules to only trusted systems.

**Name of the Vulnerable Software and Affected Versions** OpenOlat versions prior to 15.5.8 OpenOlat versions prior to 16.0.1 **Description** OpenOlat is a web-based e-learning platform. In affected versions, an attacker can modify the path of a requested file download in the folder component to point to anywhere on the target system by manipulating the HTTP request. This could allow reading of any file accessible in the web root folder or outside, depending on the system configuration and application server user permissions. The attack requires an OpenOlat user account or the enabled guest user feature, along with the usage of the folder component in a course. It only allows reading of files, not writing, and the attacker must know the exact path of the file. **Recommendations** For versions prior to 15.5.8, upgrade to version 15.5.8 or later. For versions prior to 16.0.1, upgrade to version 16.0.1 or later. As a general recommendation, consider upgrading to version 16.0.x to ensure the issue is resolved. At the moment, there are no known workarounds to fix this problem, an upgrade is necessary.

**Name of the Vulnerable Software and Affected Versions** OpenOlat versions prior to 15.3.18, 15.5.3, and 16.0.0 **Description** OpenOlat is a web-based learning management system. The issue allows an attacker to execute arbitrary code using a prepared import XML file, such as a course, which can instantiate any class on the Java classpath, including spring AOP bean factories. This requires an OpenOlat user account with the authoring role and cannot be exploited by unregistered users. **Recommendations** For versions prior to 15.3.18, upgrade to version 15.3.18 or later. For versions prior to 15.5.3, upgrade to version 15.5.3 or later. For versions prior to 16.0.0, upgrade to version 16.0.0 or later.

**Name of the Vulnerable Software and Affected Versions** OpenOLAT versions prior to 15.3.18 OpenOLAT versions prior to 15.5.3 OpenOLAT versions prior to 16.0.0 **Description** A path traversal vulnerability exists in OpenOLAT, a web-based learning management system. Using a specially prepared ZIP file, it is possible to overwrite any file that is writable by the application server user. Depending on the configuration, this can be limited to files of the OpenOlat user data directory, or it could also be used to overwrite application server config files, java code, or even operating system files. The attack could be used to corrupt or modify any OpenOlat file, such as course structures, config files, or temporary test data. If the app server configuration allows the execution of jsp files and the path to the context is known, it is also possible to execute java code. If the app server runs with the same user that is used to deploy the OpenOlat code or has write permissions on the OpenOlat code files and the path to the context is known, code injection is possible. The attack requires an OpenOlat user account to upload a ZIP file and trigger the unzip method. **Recommendations** For OpenOLAT versions prior to 15.3.18, upgrade to version 15.3.18 or later. For OpenOLAT versions prior to 15.5.3, upgrade to version 15.5.3 or later. For OpenOLAT versions prior to 16.0.0, upgrade to version 16.0.0 or later.