Date:
2024-August-21
Vulnerability:
Arbitrary PHP code execution
CVE IDs:
CVE-2024-13268
Description:
The Opigno module is related to Opigno LMS distribution. Opigno Scorm submodule exposes an API for extracting and handling SCORM packages.
Uploaded files were not sufficiently validated to prevent arbitrary file uploads, which could lead to Remote Code Execution (RCE) and/or Cross Site Scripting (XSS).
This vulnerability is mitigated by the fact that it affected only specific activity types.
Solution:
Install the latest version:
- If you use the opigno module, upgrade to opigno 7.x-1.23
Reported By:
- Yurii Boichenko
- Marcin Grabias
- catch of the Drupal Security Team
Fixed By:
Coordinated By:
- Greg Knaddison of the Drupal Security Team
- Juraj Nemec of the Drupal Security Team
