CVE-2026-33715

{"id": "CVE-2026-33715", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33715", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-15T13:36:55.706592Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "chamilo", "product": "chamilo-lms", "versions": [{"status": "affected", "version": ">= 2.0-RC.2, < 2.0-RC.3"}]}]}], "published": "2026-04-14T21:16:26.060", "references": [{"url": "https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.0-RC.3", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-mxc9-9335-45mc", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-306"}, {"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Chamilo LMS is an open-source learning management system. In version 2.0-RC.2, the file public/main/inc/ajax/install.ajax.php is accessible without authentication on fully installed instances because, unlike other AJAX endpoints, it does not include the global.inc.php file that performs authentication and installation-completed checks. Its test_mailer action accepts an arbitrary Symfony Mailer DSN string from POST data and uses it to connect to an attacker-specified SMTP server, enabling Server-Side Request Forgery (SSRF) into internal networks via the SMTP protocol. An unauthenticated attacker can also abuse this to weaponize the Chamilo server as an open email relay for phishing and spam campaigns, with emails appearing to originate from the server's IP address. Additionally, error responses from failed SMTP connections may disclose information about internal network topology and running services. This issue has been fixed in version 2.0.0-RC.3."}, {"lang": "es", "value": "Chamilo LMS es un sistema de gesti\u00f3n de aprendizaje de c\u00f3digo abierto. En la versi\u00f3n 2.0-RC.2, el archivo public/main/inc/ajax/install.ajax.php es accesible sin autenticaci\u00f3n en instancias completamente instaladas porque, a diferencia de otros puntos finales AJAX, no incluye el archivo global.inc.php que realiza comprobaciones de autenticaci\u00f3n y de instalaci\u00f3n completada. Su acci\u00f3n test_mailer acepta una cadena DSN arbitraria de Symfony Mailer de los datos POST y la utiliza para conectarse a un servidor SMTP especificado por el atacante, lo que permite la falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF) en redes internas a trav\u00e9s del protocolo SMTP. Un atacante no autenticado tambi\u00e9n puede abusar de esto para convertir el servidor Chamilo en un rel\u00e9 de correo electr\u00f3nico abierto para campa\u00f1as de phishing y correo no deseado, con correos electr\u00f3nicos que parecen originarse de la direcci\u00f3n IP del servidor. Adem\u00e1s, las respuestas de error de las conexiones SMTP fallidas pueden revelar informaci\u00f3n sobre la topolog\u00eda de la red interna y los servicios en ejecuci\u00f3n. Este problema ha sido solucionado en la versi\u00f3n 2.0.0-RC.3."}], "lastModified": "2026-07-24T23:10:00.563", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:chamilo:chamilo_lms:2.0.0:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DAF96697-6B6D-459D-9510-E5CEEDC2859B"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}