CVE-2025-11345
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-11345
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-11345.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-11345
- Published
- 2025-10-06T19:15:34.703Z
- Modified
- 2025-11-20T12:32:57.830404Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
A flaw has been found in ILIAS up to 8.23/9.13/10.1. Affected by this issue is the function unserialize of the component Test Import. This manipulation causes deserialization. It is possible to initiate the attack remotely. Upgrading to version 8.24, 9.14 and 10.2 can resolve this issue. Upgrading the affected component is advised.
- References
Affected packages
Git / github.com/ilias-elearning/ilias
Affected ranges
- Type
- GIT
- Repo
- https://github.com/ilias-elearning/ilias
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedLast affectedLast affectedLast affected
Affected versions
4.*
4.3.9
4.4.4
4.4.5
4.4.6
4.4.7
5.*
5.0.0
5.0.0_beta2
v10.*
v10.0
v10.0_beta1
v10.0_beta2
v10.0_beta3
v10.1
v5.*
v5.1.0
v5.1.0beta1
v5.1.0beta2
v5.2.0
v5.2.0beta1
v5.3.0beta1
v5.3.0beta2
v8.*
v8.0_beta1
v8.0_beta2
v8.0_beta3
v8.0_beta4
v8.1
v8.10
v8.11
v8.12
v8.13
v8.14
v8.15
v8.16
v8.17
v8.18
v8.19
v8.2
v8.20
v8.21
v8.22
v8.23
v8.3
v8.4
v8.5
v8.6
v8.7
v8.8
v8.9
v9.*
v9.0
v9.0_beta1
v9.0_beta2
v9.0_beta3
v9.1
v9.10
v9.12
v9.13
v9.2
v9.3
v9.4
v9.5
v9.6
v9.7
v9.8
v9.9