CVE-2022-37160

MEDIUM 5.4CVE-2022-37160 · Published 25/08/2022 · updated 17/06/2026

In short

CVE-2022-37160 is a MEDIUM (CVSS 5.4) vulnerability affecting claroline (claroline).
Chance of exploitation in the next 30 days (EPSS): 0.63%, higher than 50.1% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
claroline claroline	`≤ 13.5.7`	No fix yet

Description

Claroline 13.5.7 and prior allows an authenticated attacker to elevate privileges via the arbitrary creation of a privileged user. By combining the XSS vulnerability present in several upload forms and a javascript request to the present API, it is possible to trigger the creation of a user with administrative rights by opening an SVG file as an administrator user.

References

matthieu-hackwitharts/claroline-CVEs · Exploit

More vulnerabilities in claroline

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

claroline

≤ 13.5.7

No fix yet

Description

More vulnerabilities in claroline

See all →