Vulnerability · Published Mar 2, 2026 · Assigned by GitHub_M
CVE-2024-50337Chamilo: Potential unauthenticated blind SSRF via openid function
Medium 5.3
In plain English
A medium-severity server-side request forgery in chamilo-lms from chamilo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.4%top 68.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Chamilo is a learning management system. Prior to version 1.11.28, the OpenId function allows anyone to send requests to any URL on server's behalf, which results in unauthenticated blind SSRF. This issue has been patched in version 1.11.28.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| chamilo | chamilo-lms | < 1.11.28 |
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N