Vulnerability · Published May 13, 2021 · Assigned by mitre
CVE-2021-32925
Medium 6.5
In plain English
A medium-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities).
Severity (CVSS NVD)6.5Medium
Exploit odds (30 days)1.7%top 23.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
admin/user_import.php in Chamilo 1.11.x reads XML data without disabling the ability to load external entities.
Affected products (as reported)
References
- https://github.com/chamilo/chamilo-lms/commit/e71437c8de809044ba3ae1b181d70857c050a3e9 x_refsource_MISC
- https://www.php.net/manual/en/function.libxml-disable-entity-loader.php x_refsource_MISC
- https://github.com/andrejspuler/writeups/blob/main/chamilo-lms/README.md#authenticated-rcelfi-in-user-import-via-xml-external-entity---cve-2021-32925 x_refsource_MISC
- https://support.chamilo.org/projects/1/wiki/Security_issues#Issue-58-2021-05-12-High-impact-very-low-risk-LFIRCE-vulnerability-in-users-import x_refsource_MISC