Security readout for executives and security teams
Plain-English summary
This is a stored cross-site scripting issue in Chamilo LMS where an administrator can place script content through extra fields management. The practical risk is limited by the need for admin privileges, but it can still affect users who view impacted administrative or application content.
Executive priority
Treat this as a low-priority remediation unless Chamilo administration is broadly delegated or admin accounts are weakly controlled. It is not evidenced as actively exploited, but affected systems should still be patched during normal maintenance.
Technical view
CVE-2023-37064 affects Chamilo 1.11.x up to 1.11.20. The CVE describes XSS insertion by an admin-privileged account in the extra fields management section. The referenced Chamilo security note labels it low impact and low risk; no CVSS, CWE, or detailed exploit evidence is provided.
Likely exposure
Exposure is likely limited to organizations running Chamilo LMS 1.11.x through 1.11.20, especially where admin accounts are shared, weakly protected, or delegated broadly.
Exploitation context
The source bundle does not show active exploitation, and KEV is false. Abuse appears to require an authenticated administrator, making this more relevant to insider risk, compromised admin accounts, or post-compromise persistence than unauthenticated internet exploitation.
Researcher notes
Evidence is sparse. The public description identifies admin-authenticated XSS in extra fields management, and the Chamilo advisory classifies it as low risk. The bundle does not provide CVSS, CWE mapping, vulnerable code details, exploit status, or a named fixed release.
Mitigation direction
- Check Chamilo vendor guidance for the fixed version or patch tied to the referenced commit.
- Upgrade Chamilo if running 1.11.x through 1.11.20.
- Restrict administrator privileges to trusted, named accounts only.
- Require strong authentication and MFA for Chamilo administrators.
- Review extra field content for unexpected script-like entries.
Validation and detection
- Inventory Chamilo versions and confirm whether any instance is 1.11.x through 1.11.20.
- Review admin account lists for shared, stale, or unnecessary privileges.
- Inspect extra fields management entries for unsafe or unexpected HTML/script content.
- Confirm the referenced vendor fix is present before closing remediation.
- Document whether compensating admin-access controls are in place.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2023-37064 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.