CVE-2023-45867

Summary

CVE-2023-45867 is a medium-criticality vulnerability affecting the ILIAS learning management system (2013-09-12 release). An attacker with privileged access, typically holding the tutor role, can exploit a Directory Traversal local file inclusion vulnerability in the ScormAicc module to gain unauthorized access to confidential files. The vulnerability allows the attacker to access files readable by the web server user www-data, potentially including sensitive configuration files and documents located outside the documentRoot. The attacker manipulates the file parameter in a URL to insert directory traversal sequences, enabling them to retrieve files such as /etc/passwd, posing a significant risk to system security and confidentiality. This vulnerability is remotely exploitable over the internet.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.