6.1

CVE-2026-32932

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an Open Redirect vulnerability in the session course edit page allows an attacker to redirect an authenticated administrator to an arbitrary external URL after saving coach assignment changes. The redirect also leaks the id_session parameter to the attacker's server. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.
Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Chamilo ≫ Chamilo Lms Version < 1.11.38
Chamilo ≫ Chamilo Lms Version2.0.0 Updatealpha1
Chamilo ≫ Chamilo Lms Version2.0.0 Updatealpha2
Chamilo ≫ Chamilo Lms Version2.0.0 Updatealpha3
Chamilo ≫ Chamilo Lms Version2.0.0 Updatealpha4
Chamilo ≫ Chamilo Lms Version2.0.0 Updatealpha5
Chamilo ≫ Chamilo Lms Version2.0.0 Updatebeta1
Chamilo ≫ Chamilo Lms Version2.0.0 Updatebeta2
Chamilo ≫ Chamilo Lms Version2.0.0 Updatebeta3
Chamilo ≫ Chamilo Lms Version2.0.0 Updaterc1
Chamilo ≫ Chamilo Lms Version2.0.0 Updaterc2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.03% 0.079
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
security-advisories@github.com 4.7 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.