CVE Catalog
CVE-2023-34958
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk0.41%
33th percentile - higher than 33% of all known CVEs
Summary
Incorrect access control in Chamilo 1.11.* up to 1.11.18 allows a student subscribed to a given course to download documents belonging to another student if they know the document's ID.
Risk Assessment
The organization may be exposed to the leakage of personal data of students, which can lead to violations of privacy and user trust.
Recommendation
It is recommended to update Chamilo to the latest version to fix the access control vulnerability and review the document access policy.
Original NVD description (English source)
Incorrect access control in Chamilo 1.11.* up to 1.11.18 allows a student subscribed to a given course to download documents belonging to another student if they know the document's ID.