Claroline 13.5.7 and prior allows an authenticated attacker to elevate privileges via the arbitrary creation of a privileged user. By combining the XSS vulnerability present in several upload forms and a javascript request to the present API, it is possible to trigger the creation of a user with administrative rights by opening an SVG file as an administrator user.
References
Link | Resource |
---|---|
https://github.com/matthieu-hackwitharts/claroline-CVEs/blob/main/csrf/csrf.md | Exploit Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2022-08-25T16:29:01
Updated: 2022-08-25T16:29:01
Reserved: 2022-08-01T00:00:00
Link: CVE-2022-37160
JSON object: View
NVD Information
Status : Analyzed
Published: 2022-08-25T17:15:08.233
Modified: 2022-08-27T03:24:25.747
Link: CVE-2022-37160
JSON object: View
Redhat Information
No data.
CWE