CVE-2023-31802

MediumCVSS 5.4

Published: 09/05/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.42%

34th percentile - higher than 34% of all known CVEs

Summary

A Cross-Site Scripting vulnerability was found in Chamilo LMS version 1.11.18. A local attacker can use the skype and linedin_url parameters to execute arbitrary JavaScript code in the victim's browser.

Risk Assessment

The risk includes session hijacking, administrator account takeover, or malware distribution within the organization.

Recommendation

Immediately update Chamilo LMS to the latest version and apply input filtering and sanitization for the skype and linedin_url parameters.

Original NVD description (English source)

Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the skype and linedin_url parameters.