Security readout for executives and security teams
Plain-English summary
Chamilo 1.11.14 has a stored cross-site scripting issue in installer-related pages. A malicious value in the port parameter could be saved and later executed in a user’s browser when viewed. Business urgency depends on whether Chamilo installer endpoints are reachable in your environment.
Executive priority
Treat this as a targeted web application exposure check, not an emergency based on current evidence. Prioritize quickly if Chamilo 1.11.14 installer pages are internet-accessible.
Technical view
The source bundle describes stored XSS through the port parameter in main/install/index.php and main/install/ajax.php for Chamilo 1.11.14. No CVSS score, CWE, CPE, affected-version range, or fixed release is provided. A referenced Chamilo commit appears relevant, but the bundle does not name a patched version.
Likely exposure
Exposure is most likely where Chamilo 1.11.14 exists and installer paths remain accessible. Internet-facing installer pages would increase risk. The bundle does not identify other affected versions or products.
Exploitation context
The bundle does not cite active exploitation, and the CVE is not marked KEV. Public references describe XSS vulnerabilities and a relevant Chamilo commit, but no confirmed exploitation-in-the-wild evidence is included.
Researcher notes
Evidence is sparse: CVE metadata names Chamilo 1.11.14 and two installer endpoints, but omits scoring and fixed-version details. Avoid expanding the affected range without vendor confirmation.
Mitigation direction
- Inventory Chamilo installations and confirm whether version 1.11.14 is present.
- Restrict access to Chamilo installer paths if they are not needed.
- Review Chamilo vendor guidance and the referenced commit for the appropriate fix path.
- Apply a vendor-supported update when a fixed release is confirmed.
- Remove or disable installer functionality after installation where Chamilo guidance supports it.
Validation and detection
- Check whether main/install/index.php and main/install/ajax.php are reachable from untrusted networks.
- Confirm the deployed Chamilo version and compare it with vendor guidance.
- Review application logs for suspicious requests involving installer pages and the port parameter.
- Verify remediation by confirming installer endpoints are inaccessible or vendor fixes are applied.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-37389 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/chamilo/chamilo-lms/commit/dfae49f5dc392c00cd43badcb3043db3a646ff0cCVE reference · x_refsource_MISC
- https://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chamilo-lms-1.11.14-xss-vulnerabilitiesCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.