Chamilo LMS Version 1.11.26 is vulnerable to Incorrect Access Control. A non-authenticated attacker can request the number of messages and the number of online users via "/main/inc/ajax/message.ajax.php?a=get_count_message" AND "/main/inc/ajax/online.ajax.php?a=get_users_online."
References
| Link | Resource |
|---|---|
| https://github.com/bahadoumi/Vulnerability-Research/tree/main/CVE-2024-30619 | Third Party Advisory |
| https://github.com/chamilo/chamilo-lms/commit/bef68ffe0552cd25b0ef760e582e1188f0f6bf4b | Patch |
Configurations
History
18 Apr 2025, 13:52
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:chamilo:chamilo_lms:1.11.26:-:*:*:*:*:*:* | |
| First Time |
Chamilo
Chamilo chamilo Lms |
|
| CWE | NVD-CWE-noinfo | |
| References | () https://github.com/bahadoumi/Vulnerability-Research/tree/main/CVE-2024-30619 - Third Party Advisory | |
| References | () https://github.com/chamilo/chamilo-lms/commit/bef68ffe0552cd25b0ef760e582e1188f0f6bf4b - Patch |
05 Nov 2024, 18:35
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
05 Nov 2024, 16:04
| Type | Values Removed | Values Added |
|---|---|---|
| Summary |
|
04 Nov 2024, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-11-04 19:15
Updated : 2025-04-18 13:52
NVD link : CVE-2024-30619
Mitre link : CVE-2024-30619
CVE.ORG link : CVE-2024-30619
JSON object : View
Products Affected
chamilo
- chamilo_lms
CWE