CVE-2023-31799

MediumCVSS 4.8

Published: 09/05/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.42%

34th percentile - higher than 34% of all known CVEs

Summary

A Cross-Site Scripting (XSS) vulnerability was found in Chamilo LMS version 1.11.18 in the system announcements parameter. It allows a local attacker to execute arbitrary JavaScript code in the victim's browser.

Risk Assessment

An attacker can hijack an administrator session, steal data, or spread malware within the organization by injecting scripts into system announcements.

Recommendation

Immediately update Chamilo LMS to the latest version and apply input filtering and output encoding for the system announcements parameter.

Original NVD description (English source)

Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the system annnouncements parameter.