CVE-2025-11345
Full vulnerability record from the local CVENow database.
Description
A flaw has been found in ILIAS up to 8.23/9.13/10.1. Affected by this issue is the function unserialize of the component Test Import. This manipulation causes deserialization. It is possible to initiate the attack remotely. Upgrading to version 8.24, 9.14 and 10.2 can resolve this issue. Upgrading the affected component is advised.
Severity
MEDIUM
CVSS score
5.1
(v4.0)
Vulnerability status
Modified
Source identifier
Published
2025-10-06 19:15:34.703000
Last modified
2026-10-19 16:10:00.260000
View original CVE JSON
{
"id": "CVE-2025-11345",
"sourceIdentifier": "[email protected]",
"published": "2025-10-06T19:15:34.703",
"lastModified": "2026-10-19T16:10:00.260",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in ILIAS up to 8.23/9.13/10.1. Affected by this issue is the function unserialize of the component Test Import. This manipulation causes deserialization. It is possible to initiate the attack remotely. Upgrading to version 8.24, 9.14 and 10.2 can resolve this issue. Upgrading the affected component is advised."
},
{
"lang": "es",
"value": "Se ha encontrado un fallo en ILIAS hasta 8.23/9.13/10.1. Afectada por este problema es la función unserialize del componente Test Import. Esta manipulación causa deserialización. Es posible iniciar el ataque de forma remota. Actualizar a la versión 8.24, 9.14 y 10.2 puede resolver este problema. Se aconseja actualizar el componente afectado."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "n/a",
"product": "ILIAS",
"cpes": [
"cpe:2.3:a:ilias:ilias:*:*:*:*:*:*:*:*"
],
"modules": [
"Test Import"
],
"versions": [
{
"version": "8.0",
"status": "affected"
},
{
"version": "8.1",
"status": "affected"
},
{
"version": "8.2",
"status": "affected"
},
{
"version": "8.3",
"status": "affected"
},
{
"version": "8.4",
"status": "affected"
},
{
"version": "8.5",
"status": "affected"
},
{
"version": "8.6",
"status": "affected"
},
{
"version": "8.7",
"status": "affected"
},
{
"version": "8.8",
"status": "affected"
},
{
"version": "8.9",
"status": "affected"
},
{
"version": "8.10",
"status": "affected"
},
{
"version": "8.11",
"status": "affected"
},
{
"version": "8.12",
"status": "affected"
},
{
"version": "8.13",
"status": "affected"
},
{
"version": "8.14",
"status": "affected"
},
{
"version": "8.15",
"status": "affected"
},
{
"version": "8.16",
"status": "affected"
},
{
"version": "8.17",
"status": "affected"
},
{
"version": "8.18",
"status": "affected"
},
{
"version": "8.19",
"status": "affected"
},
{
"version": "8.20",
"status": "affected"
},
{
"version": "8.21",
"status": "affected"
},
{
"version": "8.22",
"status": "affected"
},
{
"version": "8.23",
"status": "affected"
},
{
"version": "9.0",
"status": "affected"
},
{
"version": "9.1",
"status": "affected"
},
{
"version": "9.2",
"status": "affected"
},
{
"version": "9.3",
"status": "affected"
},
{
"version": "9.4",
"status": "affected"
},
{
"version": "9.5",
"status": "affected"
},
{
"version": "9.6",
"status": "affected"
},
{
"version": "9.7",
"status": "affected"
},
{
"version": "9.8",
"status": "affected"
},
{
"version": "9.9",
"status": "affected"
},
{
"version": "9.10",
"status": "affected"
},
{
"version": "9.11",
"status": "affected"
},
{
"version": "9.12",
"status": "affected"
},
{
"version": "9.13",
"status": "affected"
},
{
"version": "10.0",
"status": "affected"
},
{
"version": "10.1",
"status": "affected"
},
{
"version": "8.24",
"status": "unaffected"
},
{
"version": "9.14",
"status": "unaffected"
},
{
"version": "10.2",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.1,
"impactScore": 3.4
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"baseScore": 6.5,
"accessVector": "NETWORK",
"accessComplexity": "LOW",
"authentication": "SINGLE",
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"availabilityImpact": "PARTIAL"
},
"baseSeverity": "MEDIUM",
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-10-06T19:35:36.699440Z",
"id": "CVE-2025-11345",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-20"
},
{
"lang": "en",
"value": "CWE-502"
}
]
},
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-502"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ilias:ilias:8.23:*:*:*:*:*:*:*",
"matchCriteriaId": "58F9FBA3-89C9-4EC7-9913-770F9C71A569"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ilias:ilias:9.13:*:*:*:*:*:*:*",
"matchCriteriaId": "BE5461D9-97C8-4DEE-8E3D-AAEE8840A209"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ilias:ilias:10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B4E16B93-654E-47D4-A498-C759D1F4B1EB"
}
]
}
]
}
],
"references": [
{
"url": "https://docu.ilias.de/go/blog/15821/882",
"source": "[email protected]",
"tags": [
"Release Notes",
"Vendor Advisory"
]
},
{
"url": "https://vuldb.com/?ctiid.327230",
"source": "[email protected]",
"tags": [
"Permissions Required",
"VDB Entry"
]
},
{
"url": "https://vuldb.com/?id.327230",
"source": "[email protected]",
"tags": [
"Third Party Advisory",
"VDB Entry"
]
},
{
"url": "https://vuldb.com/?submit.664891",
"source": "[email protected]",
"tags": [
"Third Party Advisory",
"VDB Entry"
]
},
{
"url": "https://srlabs.de/blog/breaking-ilias-part-2-three-to-rce",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
]
}