CVE-2022-37160

Claroline 13.5.7 and prior allows an authenticated attacker to elevate privileges via the arbitrary creation of a privileged user

published August 25, 2022

CVSS
—
EPSS
1%
Percentile
49.4
In the wild
Unconfirmed
What it is

Claroline 13.5.7 and prior allows an authenticated attacker to elevate privileges via the arbitrary creation of a privileged user. By combining the XSS vulnerability present in several upload forms and a javascript request to the present API, it is possible to trigger the creation of a user with administrative rights by opening an SVG file as an administrator user.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00627 · 49.4th percentile
Published
2022-08-25T16:29Z
EPSS history
Timeline
  • 25 AUG 16:29Z
    Claroline 13.5.7 and prior allows an authenticated attacker to elevate privileges via the arbitrary creation of a privileged user
    cvelistv5