CVE-2022-37160

2022-08-2516:29:01

mitre

www.cve.org

claroline 13.5.7

privilege escalation

xss

svg file

administrative rights

5.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

24.8%

JSON

Claroline 13.5.7 and prior allows an authenticated attacker to elevate privileges via the arbitrary creation of a privileged user. By combining the XSS vulnerability present in several upload forms and a javascript request to the present API, it is possible to trigger the creation of a user with administrative rights by opening an SVG file as an administrator user.

References

github.com/matthieu-hackwitharts/claroline-CVEs/blob/main/csrf/csrf.md