—
DRUPAL-CONTRIB-2024-028
Details
The Opigno module is related to Opigno LMS distribution. It implements the module entity, that is a sub-part of a training.
In the opigno\_module module, uploaded files were not sufficiently validated to prevent arbitrary file uploads, which could lead to Remote Code Execution (RCE) and/or Cross Site Scripting (XSS).
This vulnerability is mitigated by the fact that it requires the attacker have a role with the permission "create opigno tincan activities".
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist:https://packages.drupal.org/8/drupal/opigno_module
Introduced in:
0Fixed in: 3.1.2Upgrade drupal/opigno_module to 3.1.2 or newer (ecosystem packagist:https://packages.drupal.org/8).