CVE-2023-36485

Summary

CVE-2023-36485 is a vulnerability that affects ILIAS versions before 7.23 and 8 before 8.3. It allows remote authenticated users to execute arbitrary system commands on the application server by exploiting a malicious BPMN2 workflow definition file. The vulnerability has a high severity rating with a base score of 7.2 and impacts the integrity and confidentiality of the organization's data. The exploitability score is low at 1.2, and it requires high privileges to be exploited. The attack vector is through the network, and there is no user interaction required. The potential danger posed to an organization is significant as it can lead to unauthorized access and control over the application server, potentially resulting in data breaches or other malicious activities. To remediate the vulnerability, organizations should update their ILIAS installations to version 7.23 or 8.3 or apply any patches or security updates provided by the vendor promptly.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.