EXPOSURES › CVE-2023-34960

CVE-2023-34960

CRITICAL

DETAIL

SourceNVD · cve Published2023-08-01 CVSS9.8 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2023-34960 ↗

⚡ RCE SHAME 50/100 rce

A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API call with a crafted PowerPoint name.

▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.

PLAYERS IMPLICATED

chamilo · vendor chamilo · product

DESCRIPTION

A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API call with a crafted PowerPoint name.

AFFECTED FEDRAMP PRODUCTS · 0

No correlated FedRAMP products.