Paper/Archive/CVE-2025-11345

CVE-2025-11345

VulDB — ILIAS Test Import unserialize deserialization

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 30.8.308 × 206.2 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A flaw has been found in ILIAS up to 8.23/9.13/10.1. Affected by this issue is the function unserialize of the component Test Import. This manipulation causes deserialization. It is possible to initiate the attack remotely. Upgrading to version 8.24, 9.14 and 10.2 can resolve this issue. Upgrading the affected component is advised.

Affected

ProductAffectedFixed inSource

ILIAS8.08.24CNA

ILIAS8.18.24CNA

ILIAS8.28.24CNA

ILIAS8.38.24CNA

ILIAS8.48.24CNA

ILIAS8.58.24CNA

ILIAS8.68.24CNA

ILIAS8.78.24CNA

ILIAS8.88.24CNA

ILIAS8.98.24CNA

ILIAS8.108.24CNA

ILIAS8.118.24CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

VulDB (CNA)5.5CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

VulDB (CNA)5.5CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

VulDB (CNA)5.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

writeupvuldb.com/?id.327230 refvuldb.com/?ctiid.327230 writeupvuldb.com/?submit.664891 refdocu.ilias.de/go/blog/15821/882 refsrlabs.de/blog/breaking-ilias-part-2-three-to-rce