Vulnerability Description
The workflow-engine of ILIAS before 7.23 and 8 before 8.3 allows remote authenticated users to run arbitrary system commands on the application server as the application user by uploading a workflow definition file with a malicious filename.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ilias | Ilias | < 7.23 |
References
- https://docu.ilias.de/ilias.php?baseClass=ilrepositorygui&cmdNode=xd:kx:54&cmdClVendor Advisory
- https://github.com/ILIAS-eLearning/ILIAS/pull/5987Patch
- https://github.com/ILIAS-eLearning/ILIAS/pull/5988Patch
- https://docu.ilias.de/ilias.php?baseClass=ilrepositorygui&cmdNode=xd:kx:54&cmdClVendor Advisory
- https://github.com/ILIAS-eLearning/ILIAS/pull/5987Patch
- https://github.com/ILIAS-eLearning/ILIAS/pull/5988Patch
FAQ
What is CVE-2023-36486?
CVE-2023-36486 is a vulnerability with a CVSS score of 7.2 (HIGH). The workflow-engine of ILIAS before 7.23 and 8 before 8.3 allows remote authenticated users to run arbitrary system commands on the application server as the application user by uploading a workflow d...
How severe is CVE-2023-36486?
CVE-2023-36486 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-36486?
Check the references section above for vendor advisories and patch information. Affected products include: Ilias Ilias.