CVE-2023-45869

    Dashboard / Vulnerabilities / CVE-2023-45869

    CVE-2023-45869

    Published: 26 Oct 2023Last Modified: 28 Oct 2026

    Summary:

    Details: ILIAS 7.25 (2023-09-12) allows any authenticated user to execute arbitrary operating system commands remotely, when a highly privileged account accesses an XSS payload. The injected commands are executed via the exec() function in the execQuoted() method of the ilUtil class (/Services/Utilities/classes/class.ilUtil.php) This allows attackers to inject malicious commands into the system, potentially compromising the integrity, confidentiality, and availability of the ILIAS installation and the underlying operating system.

    References: https://rehmeinfosec.de/labor/cve-2023-45869, https://rehmeinfosec.de/report/358ad5f6-f712-4f74-a5ee-476efc856cbc/, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45869.json, https://nvd.nist.gov/vuln/detail/CVE-2023-45869

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 97b309d3d5b1c61241ee08b7783534bd1bcbf34a
    Fixed -None

    Affected versions

    7.25

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High