CVE-2022-37160

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-08-25 · updated 2026-06-17
Weakness: CWE-79

Description

Claroline 13.5.7 and prior allows an authenticated attacker to elevate privileges via the arbitrary creation of a privileged user. By combining the XSS vulnerability present in several upload forms and a javascript request to the present API, it is possible to trigger the creation of a user with administrative rights by opening an SVG file as an administrator user.

Affected products

Claroline: through 13.5.7

References

https://github.com/matthieu-hackwitharts/claroline-CVEs/blob/main/csrf/csrf.md
https://github.com/matthieu-hackwitharts/claroline-CVEs/blob/main/csrf/csrf.md

Get alerted when CVE-2022-37160 or the next vulnerability affects your stack