{"id":"CVE-2020-23996","details":"A local file inclusion vulnerability in ILIAS before 5.3.19, 5.4.10 and 6.0 allows remote authenticated attackers to execute arbitrary code via the import of personal data.","modified":"2026-07-09T00:06:39.597668Z","published":"2021-05-13T20:15:08.253Z","references":[{"type":"ADVISORY","url":"https://docu.ilias.de/goto_docu_pg_118817_35.html"},{"type":"ADVISORY","url":"https://docu.ilias.de/goto_docu_pg_118823_35.html"},{"type":"ADVISORY","url":"https://docu.ilias.de/goto_docu_pg_122177_35.html"},{"type":"FIX","url":"https://github.com/ILIAS-eLearning/ILIAS/commit/6717c4ecc6d076154ce185f1ea052f07f37e3537"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/ilias-elearning/ilias","events":[{"introduced":"0"},{"fixed":"7e936b3e570354cf151c05d4b0bff4d41fcef347"},{"introduced":"d2e2132a27c1e8c8c2874ead01d44d71b5b55338"},{"fixed":"d2fb3223d7e7dc64d55c29a79dc7f23fcb3f8fcb"},{"fixed":"6717c4ecc6d076154ce185f1ea052f07f37e3537"}],"database_specific":{"cpe":"cpe:2.3:a:ilias:ilias:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"5.3.19"},{"introduced":"5.4.0"},{"fixed":"5.4.10"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v5.4.7","v5.3.17","v5.3.16","v5.4.0-beta.1","v5.3.9","v5.3.5","v5.3.4","v5.3.2","v5.3.0beta4","v5.3.0beta3","v5.3.0beta1","v5.1.0beta2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-23996.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}