RCE in Ilias

CVE-2014-2089

ILIAS 4.4.1 allows remote attackers to execute arbitrary PHP code via an e-mail attachment that leads to creation of a .php file with a certain client_id pathname.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.026 (83.9th percentile) — read the EPSS interpretation.

Affected products

  • Ilias — versions 4.4.1
  • N/a — versions n/a

Weakness classification (CWE)

References