CVE-2025-11345

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11345", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2025-10-06T06:15:35.341Z", "datePublished": "2025-10-06T19:02:05.514Z", "dateUpdated": "2026-02-24T06:46:15.365Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-24T06:46:15.365Z"}, "title": "ILIAS Test Import unserialize deserialization", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-502", "lang": "en", "description": "Deserialization"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-20", "lang": "en", "description": "Improper Input Validation"}]}], "affected": [{"vendor": "n/a", "product": "ILIAS", "versions": [{"version": "8.0", "status": "affected"}, {"version": "8.1", "status": "affected"}, {"version": "8.2", "status": "affected"}, {"version": "8.3", "status": "affected"}, {"version": "8.4", "status": "affected"}, {"version": "8.5", "status": "affected"}, {"version": "8.6", "status": "affected"}, {"version": "8.7", "status": "affected"}, {"version": "8.8", "status": "affected"}, {"version": "8.9", "status": "affected"}, {"version": "8.10", "status": "affected"}, {"version": "8.11", "status": "affected"}, {"version": "8.12", "status": "affected"}, {"version": "8.13", "status": "affected"}, {"version": "8.14", "status": "affected"}, {"version": "8.15", "status": "affected"}, {"version": "8.16", "status": "affected"}, {"version": "8.17", "status": "affected"}, {"version": "8.18", "status": "affected"}, {"version": "8.19", "status": "affected"}, {"version": "8.20", "status": "affected"}, {"version": "8.21", "status": "affected"}, {"version": "8.22", "status": "affected"}, {"version": "8.23", "status": "affected"}, {"version": "9.0", "status": "affected"}, {"version": "9.1", "status": "affected"}, {"version": "9.2", "status": "affected"}, {"version": "9.3", "status": "affected"}, {"version": "9.4", "status": "affected"}, {"version": "9.5", "status": "affected"}, {"version": "9.6", "status": "affected"}, {"version": "9.7", "status": "affected"}, {"version": "9.8", "status": "affected"}, {"version": "9.9", "status": "affected"}, {"version": "9.10", "status": "affected"}, {"version": "9.11", "status": "affected"}, {"version": "9.12", "status": "affected"}, {"version": "9.13", "status": "affected"}, {"version": "10.0", "status": "affected"}, {"version": "10.1", "status": "affected"}, {"version": "8.24", "status": "unaffected"}, {"version": "9.14", "status": "unaffected"}, {"version": "10.2", "status": "unaffected"}], "cpes": ["cpe:2.3:a:ilias:ilias:*:*:*:*:*:*:*:*"], "modules": ["Test Import"]}], "descriptions": [{"lang": "en", "value": "A flaw has been found in ILIAS up to 8.23/9.13/10.1. Affected by this issue is the function unserialize of the component Test Import. This manipulation causes deserialization. It is possible to initiate the attack remotely. Upgrading to version 8.24, 9.14 and 10.2 can resolve this issue. Upgrading the affected component is advised."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C"}}], "timeline": [{"time": "2025-10-06T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2025-10-06T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2025-10-15T09:15:18.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "rehme_srlabs (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.327230", "name": "VDB-327230 | ILIAS Test Import unserialize deserialization", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.327230", "name": "VDB-327230 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.664891", "name": "Submit #664891 | ILIAS open source e-Learning e. V. ILIAS >=8.0.0, <=10.1 Deserialization", "tags": ["third-party-advisory"]}, {"url": "https://docu.ilias.de/go/blog/15821/882", "tags": ["related"]}], "tags": ["x_open-source"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-06T19:35:36.699440Z", "id": "CVE-2025-11345", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-06T19:35:49.946Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-01-23T18:24:14.342Z"}, "references": [{"url": "https://srlabs.de/blog/breaking-ilias-part-2-three-to-rce"}], "title": "CVE Program Container", "x_generator": {"engine": "ADPogram 0.0.1"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://srlabs.de/blog/breaking-ilias-part-2-three-to-rce"}], "x_generator": {"engine": "ADPogram 0.0.1"}, "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-01-23T18:24:14.342Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11345", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-06T19:35:36.699440Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-06T19:35:42.489Z"}}], "cna": {"tags": ["x_open-source"], "title": "ILIAS Test Import unserialize deserialization", "credits": [{"lang": "en", "type": "reporter", "value": "rehme_srlabs (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:ilias:ilias:*:*:*:*:*:*:*:*"], "vendor": "n/a", "modules": ["Test Import"], "product": "ILIAS", "versions": [{"status": "affected", "version": "8.0"}, {"status": "affected", "version": "8.1"}, {"status": "affected", "version": "8.2"}, {"status": "affected", "version": "8.3"}, {"status": "affected", "version": "8.4"}, {"status": "affected", "version": "8.5"}, {"status": "affected", "version": "8.6"}, {"status": "affected", "version": "8.7"}, {"status": "affected", "version": "8.8"}, {"status": "affected", "version": "8.9"}, {"status": "affected", "version": "8.10"}, {"status": "affected", "version": "8.11"}, {"status": "affected", "version": "8.12"}, {"status": "affected", "version": "8.13"}, {"status": "affected", "version": "8.14"}, {"status": "affected", "version": "8.15"}, {"status": "affected", "version": "8.16"}, {"status": "affected", "version": "8.17"}, {"status": "affected", "version": "8.18"}, {"status": "affected", "version": "8.19"}, {"status": "affected", "version": "8.20"}, {"status": "affected", "version": "8.21"}, {"status": "affected", "version": "8.22"}, {"status": "affected", "version": "8.23"}, {"status": "affected", "version": "9.0"}, {"status": "affected", "version": "9.1"}, {"status": "affected", "version": "9.2"}, {"status": "affected", "version": "9.3"}, {"status": "affected", "version": "9.4"}, {"status": "affected", "version": "9.5"}, {"status": "affected", "version": "9.6"}, {"status": "affected", "version": "9.7"}, {"status": "affected", "version": "9.8"}, {"status": "affected", "version": "9.9"}, {"status": "affected", "version": "9.10"}, {"status": "affected", "version": "9.11"}, {"status": "affected", "version": "9.12"}, {"status": "affected", "version": "9.13"}, {"status": "affected", "version": "10.0"}, {"status": "affected", "version": "10.1"}, {"status": "unaffected", "version": "8.24"}, {"status": "unaffected", "version": "9.14"}, {"status": "unaffected", "version": "10.2"}]}], "timeline": [{"lang": "en", "time": "2025-10-06T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2025-10-06T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2025-10-15T09:15:18.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.327230", "name": "VDB-327230 | ILIAS Test Import unserialize deserialization", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.327230", "name": "VDB-327230 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.664891", "name": "Submit #664891 | ILIAS open source e-Learning e. V. ILIAS >=8.0.0, <=10.1 Deserialization", "tags": ["third-party-advisory"]}, {"url": "https://docu.ilias.de/go/blog/15821/882", "tags": ["related"]}], "descriptions": [{"lang": "en", "value": "A flaw has been found in ILIAS up to 8.23/9.13/10.1. Affected by this issue is the function unserialize of the component Test Import. This manipulation causes deserialization. It is possible to initiate the attack remotely. Upgrading to version 8.24, 9.14 and 10.2 can resolve this issue. Upgrading the affected component is advised."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "Deserialization"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "Improper Input Validation"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-24T06:46:15.365Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11345", "state": "PUBLISHED", "dateUpdated": "2026-02-24T06:46:15.365Z", "dateReserved": "2025-10-06T06:15:35.341Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2025-10-06T19:02:05.514Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:ilias:ilias:*:*:*:*:*:*:*:*"], "modules": ["Test Import"], "product": "ILIAS", "vendor": "n/a", "versions": [{"status": "affected", "version": "8.0"}, {"status": "affected", "version": "8.1"}, {"status": "affected", "version": "8.2"}, {"status": "affected", "version": "8.3"}, {"status": "affected", "version": "8.4"}, {"status": "affected", "version": "8.5"}, {"status": "affected", "version": "8.6"}, {"status": "affected", "version": "8.7"}, {"status": "affected", "version": "8.8"}, {"status": "affected", "version": "8.9"}, {"status": "affected", "version": "8.10"}, {"status": "affected", "version": "8.11"}, {"status": "affected", "version": "8.12"}, {"status": "affected", "version": "8.13"}, {"status": "affected", "version": "8.14"}, {"status": "affected", "version": "8.15"}, {"status": "affected", "version": "8.16"}, {"status": "affected", "version": "8.17"}, {"status": "affected", "version": "8.18"}, {"status": "affected", "version": "8.19"}, {"status": "affected", "version": "8.20"}, {"status": "affected", "version": "8.21"}, {"status": "affected", "version": "8.22"}, {"status": "affected", "version": "8.23"}, {"status": "affected", "version": "9.0"}, {"status": "affected", "version": "9.1"}, {"status": "affected", "version": "9.2"}, {"status": "affected", "version": "9.3"}, {"status": "affected", "version": "9.4"}, {"status": "affected", "version": "9.5"}, {"status": "affected", "version": "9.6"}, {"status": "affected", "version": "9.7"}, {"status": "affected", "version": "9.8"}, {"status": "affected", "version": "9.9"}, {"status": "affected", "version": "9.10"}, {"status": "affected", "version": "9.11"}, {"status": "affected", "version": "9.12"}, {"status": "affected", "version": "9.13"}, {"status": "affected", "version": "10.0"}, {"status": "affected", "version": "10.1"}, {"status": "unaffected", "version": "8.24"}, {"status": "unaffected", "version": "9.14"}, {"status": "unaffected", "version": "10.2"}]}], "source": "cna@vuldb.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ilias:ilias:8.23:*:*:*:*:*:*:*", "matchCriteriaId": "58F9FBA3-89C9-4EC7-9913-770F9C71A569", "vulnerable": true}, {"criteria": "cpe:2.3:a:ilias:ilias:9.13:*:*:*:*:*:*:*", "matchCriteriaId": "BE5461D9-97C8-4DEE-8E3D-AAEE8840A209", "vulnerable": true}, {"criteria": "cpe:2.3:a:ilias:ilias:10.1:*:*:*:*:*:*:*", "matchCriteriaId": "B4E16B93-654E-47D4-A498-C759D1F4B1EB", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw has been found in ILIAS up to 8.23/9.13/10.1. Affected by this issue is the function unserialize of the component Test Import. This manipulation causes deserialization. It is possible to initiate the attack remotely. Upgrading to version 8.24, 9.14 and 10.2 can resolve this issue. Upgrading the affected component is advised."}, {"lang": "es", "value": "Se ha encontrado un fallo en ILIAS hasta 8.23/9.13/10.1. Afectada por este problema es la funci\u00f3n unserialize del componente Test Import. Esta manipulaci\u00f3n causa deserializaci\u00f3n. Es posible iniciar el ataque de forma remota. Actualizar a la versi\u00f3n 8.24, 9.14 y 10.2 puede resolver este problema. Se aconseja actualizar el componente afectado."}], "id": "CVE-2025-11345", "lastModified": "2026-10-19T16:10:00.260", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11345", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-06T19:35:36.699440Z", "version": "2.0.3"}}]}, "published": "2025-10-06T19:15:34.703", "references": [{"source": "cna@vuldb.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://docu.ilias.de/go/blog/15821/882"}, {"source": "cna@vuldb.com", "tags": ["Permissions Required", "VDB Entry"], "url": "https://vuldb.com/?ctiid.327230"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?id.327230"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?submit.664891"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://srlabs.de/blog/breaking-ilias-part-2-three-to-rce"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-502"}], "source": "cna@vuldb.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-502"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"created": "2025-10-08T13:39:14.510946+00:00", "updated": "2025-10-08T13:39:14.510976+00:00", "vendors": ["ilias", "ilias$PRODUCT$ilias"]}