High severity · published Mar 11, 2024
CVE-2024-28198
XML external entity (XXE) injection in OpenOLAT
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication. By manually manipulating http requests when using the draw.io integration it is possible to read arbitrary files as the configured system user and SSRF. The problem is fixed in version 18.1.6 and 18.2.2. It is advised to upgrade to the latest version of 18.1.x or 18.2.x. Users unable to upgrade may work around this issue by disabling the Draw.io module or the entire REST API which will secure the system.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
OpenOLAT · OpenOLAT
< 18.1.6 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-28198
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-28198
Patch
https://github.com/OpenOLAT/OpenOLAT/commit/23e6212e9412c3b099436159b8c8935321c91872
Vendor Advisory
https://github.com/OpenOLAT/OpenOLAT/security/advisories/GHSA-pqvm-h9mg-434c
Broken Link
https://track.frentix.com/issue/OO-7553/XXE-injection-in-draw.io-endpoint
More from OpenOLAT
9.8
CVE-2026-31946
OpenOLAT: Authentication bypass via forged JWT in OIDC implicit flow
8.8
CVE-2026-28228
OpenOLAT: Server-Side Template Injection (SSTI) in Velocity templates allows Remote Code Execution