1. Home
  2. CVE Database
  3. CVE-2022-37160
MEDIUM · 5.4

CVE-2022-37160

Claroline 13.5.7 and prior allows an authenticated attacker to elevate privileges via the arbitrary creation of a privileged user. By combining the XSS vulnerability present in several upload forms an...

Vulnerability Description

Claroline 13.5.7 and prior allows an authenticated attacker to elevate privileges via the arbitrary creation of a privileged user. By combining the XSS vulnerability present in several upload forms and a javascript request to the present API, it is possible to trigger the creation of a user with administrative rights by opening an SVG file as an administrator user.

CVSS Score

5.4

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
ClarolineClaroline<= 13.5.7

Related Weaknesses (CWE)

CWE-79

References

FAQ

What is CVE-2022-37160?

CVE-2022-37160 is a vulnerability with a CVSS score of 5.4 (MEDIUM). Claroline 13.5.7 and prior allows an authenticated attacker to elevate privileges via the arbitrary creation of a privileged user. By combining the XSS vulnerability present in several upload forms an...

How severe is CVE-2022-37160?

CVE-2022-37160 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-37160?

Check the references section above for vendor advisories and patch information. Affected products include: Claroline Claroline.