Cyber Resilience

CVE-2023-3545

Chamilo ≤ 1.11.20

Public PoC
Published
28 November 2023
Modified
21 November 2024
Patch / advisory
View advisory
CVSS Score v3.1 9.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.020 79th percentile
Risk Priority 76 floored blend · peak EPSS

Summary

CVE-2023-3545 is a critical-severity Improper Handling of Case Sensitivity (CWE-178) vulnerability in Chamilo Chamilo. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Masquerading (T1036); ranked in the top 21% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability Data

Improper sanitisation in `main/inc/lib/fileUpload.lib.php` in Chamilo LMS <= v1.11.20 on Windows and Apache installations allows unauthenticated attackers to bypass file upload security protections and obtain remote code execution via uploading of `.htaccess` file. This vulnerability may be exploited by privileged…

more

attackers or chained with unauthenticated arbitrary file write vulnerabilities, such as CVE-2023-3533, to achieve remote code execution.

CWE(s)
CWE-178

Related Threats

MITRE ATT&CK Enterprise Techniques

T1036 Masquerading Stealth
Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-39061Same product: Chamilo Chamilo
CVE-2023-3533Same product: Chamilo Chamilo
CVE-2023-37065Same product: Chamilo Chamilo
CVE-2023-37067Same product: Chamilo Chamilo
CVE-2023-37061Same product: Chamilo Chamilo
CVE-2023-37064Same product: Chamilo Chamilo
CVE-2023-3368Same product: Chamilo Chamilo
CVE-2023-37066Same product: Chamilo Chamilo
CVE-2023-37063Same product: Chamilo Chamilo
CVE-2023-37062Same product: Chamilo Chamilo

Affected Assets

chamilo
chamilo
≤ 1.11.20

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 partial match
prevents

Secure SDLC practices can catch and prevent case-sensitivity flaws during code review or testing, but fixing one CWE achieves negligible coverage of the broad control.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.25 Secure development life cycle partial match
prevents

Secure SDLC practices should include case-sensitivity requirements in design and coding standards.

A.8.26 Application security requirements partial match
prevents

Application security requirements must specify case handling for identifiers and paths.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Architecture principles should enforce canonical, case-aware resource naming.

A.8.28 Secure coding partial match
prevents

Secure coding guidelines must mandate explicit case handling to prevent inconsistent lookups.

A.8.3 Information access restriction partial match
degrades

Access-control rules that ignore case can allow unintended resource access.

A.8.5 Secure authentication partial match
degrades

Authentication logic must treat identifiers consistently to avoid bypass via case differences.

References