CVSS 3.1 Score 7.2 of 10 (high)


Published Dec 25, 2023
Updated: Feb 14, 2024


CVE-2023-36485 is a vulnerability that affects ILIAS versions before 7.23 and 8 before 8.3. It allows remote authenticated users to execute arbitrary system commands on the application server by exploiting a malicious BPMN2 workflow definition file. The vulnerability has a high severity rating with a base score of 7.2 and impacts the integrity and confidentiality of the organization's data. The exploitability score is low at 1.2, and it requires high privileges to be exploited. The attack vector is through the network, and there is no user interaction required. The potential danger posed to an organization is significant as it can lead to unauthorized access and control over the application server, potentially resulting in data breaches or other malicious activities. To remediate the vulnerability, organizations should update their ILIAS installations to version 7.23 or 8.3 or apply any patches or security updates provided by the vendor promptly.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-36485 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options