CVE-2022-45915

Deeper analysis

ILIAS versions prior to 7.16 contain an OS command injection vulnerability, tracked as CVE-2022-45915 and assigned CWE-78. The flaw received a CVSS 3.1 score of 8.8, reflecting network attack vector, low complexity, and low privileges required. It affects the open-source ILIAS e-learning platform and permits arbitrary operating-system command execution when triggered.

An authenticated attacker with low privileges can send specially crafted input over the network to execute commands on the underlying server, resulting in full confidentiality, integrity, and availability impact without user interaction. Public proof-of-concept material demonstrates the issue alongside related flaws such as XSS, LFI, and open redirect in the same product versions.

Advisories published through Full Disclosure and SEC Consult, along with associated Packet Storm entries, document the command-injection vector and point to the availability of a fixed release. The vendor addressed the problem by releasing ILIAS 7.16.

EPSS scores for the CVE reached a peak of 0.0728 well after initial disclosure before receding to the current value of 0.0488; the modest movement does not indicate sustained exploitation interest.