ILIAS Base64 Decoding unserialize deserialization_CVE-2025-11346

5.3 / 10

MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X

Description

A vulnerability has been found in ILIAS up to 8.23/9.13/10.1. This affects the function unserialize of the component Base64 Decoding Handler. Such manipulation of the argument f_settings leads to deserialization. It is possible to launch the attack remotely. Upgrading to version 8.24, 9.14 and 10.2 is able to mitigate this issue. It is advisable to upgrade the affected component.

Basic Information

ID CVE-2025-11346

Source VulDB

Published Oct 6, 2025 at 19:32

Modified Oct 6, 2025 at 19:43

Affected Product

Vendor n/a

Product ILIAS

Version 8.0

Affected Versions n/a ILIAS 8.0
n/a ILIAS 8.1
n/a ILIAS 8.2
n/a ILIAS 8.3
n/a ILIAS 8.4
n/a ILIAS 8.5
n/a ILIAS 8.6
n/a ILIAS 8.7
n/a ILIAS 8.8
n/a ILIAS 8.9
n/a ILIAS 8.10
n/a ILIAS 8.11
n/a ILIAS 8.12
n/a ILIAS 8.13
n/a ILIAS 8.14
n/a ILIAS 8.15
n/a ILIAS 8.16
n/a ILIAS 8.17
n/a ILIAS 8.18
n/a ILIAS 8.19
n/a ILIAS 8.20
n/a ILIAS 8.21
n/a ILIAS 8.22
n/a ILIAS 8.23
n/a ILIAS 9.0
n/a ILIAS 9.1
n/a ILIAS 9.2
n/a ILIAS 9.3
n/a ILIAS 9.4
n/a ILIAS 9.5
n/a ILIAS 9.6
n/a ILIAS 9.7
n/a ILIAS 9.8
n/a ILIAS 9.9
n/a ILIAS 9.10
n/a ILIAS 9.11
n/a ILIAS 9.12
n/a ILIAS 9.13
n/a ILIAS 10.0
n/a ILIAS 10.1

CWE Classification

CWE-502 CWE-20

References

{
    "lastseen": "",
    "description": "A vulnerability has been found in ILIAS up to 8.23/9.13/10.1. This affects the function unserialize of the component Base64 Decoding Handler. Such manipulation of the argument f_settings leads to deserialization. It is possible to launch the attack remotely. Upgrading to version 8.24, 9.14 and 10.2 is able to mitigate this issue. It is advisable to upgrade the affected component.",
    "published": "2025-10-06T19:32:05.171Z",
    "modified": "2025-10-06T19:43:16.138Z",
    "type": "cve",
    "title": "ILIAS Base64 Decoding unserialize deserialization",
    "source": "VulDB",
    "references": "https://vuldb.com/?id.327231\nhttps://vuldb.com/?ctiid.327231\nhttps://vuldb.com/?submit.664892\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-2113",
    "id": "CVE-2025-11346",
    "bulletinFamily": "",
    "cwe": [
        "CWE-502",
        "CWE-20"
    ],
    "cvelist": null,
    "sourceData": "n/a ILIAS 8.0\nn/a ILIAS 8.1\nn/a ILIAS 8.2\nn/a ILIAS 8.3\nn/a ILIAS 8.4\nn/a ILIAS 8.5\nn/a ILIAS 8.6\nn/a ILIAS 8.7\nn/a ILIAS 8.8\nn/a ILIAS 8.9\nn/a ILIAS 8.10\nn/a ILIAS 8.11\nn/a ILIAS 8.12\nn/a ILIAS 8.13\nn/a ILIAS 8.14\nn/a ILIAS 8.15\nn/a ILIAS 8.16\nn/a ILIAS 8.17\nn/a ILIAS 8.18\nn/a ILIAS 8.19\nn/a ILIAS 8.20\nn/a ILIAS 8.21\nn/a ILIAS 8.22\nn/a ILIAS 8.23\nn/a ILIAS 9.0\nn/a ILIAS 9.1\nn/a ILIAS 9.2\nn/a ILIAS 9.3\nn/a ILIAS 9.4\nn/a ILIAS 9.5\nn/a ILIAS 9.6\nn/a ILIAS 9.7\nn/a ILIAS 9.8\nn/a ILIAS 9.9\nn/a ILIAS 9.10\nn/a ILIAS 9.11\nn/a ILIAS 9.12\nn/a ILIAS 9.13\nn/a ILIAS 10.0\nn/a ILIAS 10.1",
    "sourceHref": "",
    "cvss": {
        "score": 5.3,
        "severity": "MEDIUM",
        "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "ILIAS",
    "version": "8.0",
    "vendor": "n/a",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}