PT-2021-21629

CVE-2021-37389

·

Published

2021-08-10

·

Updated

2021-08-17

Description by

CVSS 3.1
6.1
Medium
MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Chamilo version 1.11.14
Description The issue allows stored XSS via "main/install/index.php" and "main/install/ajax.php" through the port parameter.
Recommendations For Chamilo version 1.11.14, as a temporary workaround, consider restricting access to the "main/install/index.php" and "main/install/ajax.php" endpoints until a patch is available. Avoid using the port parameter in these affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploitability
Exploit
Impacts
Vendors
Affected products
Weakness enumeration
CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')
Related identifiers
CVE-2021-37389
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com