CVE-2024-30619

Name of the Vulnerable Software and Affected Versions Chamilo LMS version 1.11.26

Description The issue is related to Incorrect Access Control, allowing a non-authenticated attacker to request sensitive information. Specifically, an attacker can access the number of messages and the number of online users via "/main/inc/ajax/message.ajax.php?a=get count message" and "/main/inc/ajax/online.ajax.php?a=get users online". This exposes sensitive data locally.

Recommendations For Chamilo LMS version 1.11.26, patch immediately to mitigate risks. As a temporary workaround, consider restricting access to the vulnerable API endpoints "/main/inc/ajax/message.ajax.php" and "/main/inc/ajax/online.ajax.php" to minimize the risk of exploitation.