Read the docs
TI-2024-18774 Aliases CVE-2024-28198

XML external entity (XXE) injection in OpenOLAT

Priority LOW 33CWE-611Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-611 and the CVSS impact.

Summary

OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication. By manually manipulating http requests when using the draw.io integration it is possible to read arbitrary files as the configured system user and SSRF. The problem is fixed in version 18.1.6 and 18.2.2. It is advised to upgrade to the latest version of 18.1.x or 18.2.x. Users unable to upgrade may work around this issue by disabling the Draw.io module or the entire REST API which will secure the system.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00431 37th percentileScored 2026-11-07
Fix Fixed OpenOLAT (OpenOLAT): 18.1.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenOLATOpenOLATbefore 18.1.618.1.6Patch availableCNA
  • OpenOLAT VendorOpenOLAT Affected before 18.1.6 Fixed in 18.1.6 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:frentix:openolat:*:*:*:*:*:*:*:*before 18.1.6VulnerableOpenOLAT
  • cpe:2.3:a:frentix:openolat:*:*:*:*:*:*:*:* Versions before 18.1.6 Vulnerable ·OpenOLAT

Remediation

  • Fix · CNA OpenOLAT (OpenOLAT) Fixed in 18.1.6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-28198

References

Patch 1

Advisory 1

Other 1

  • TI-2024-17072 Stored Cross-Site Scripting (XSS) within the Media Center CVSS 3.1MEDIUM 5.4
  • TI-2026-24492 OpenOLAT: Authentication bypass via forged JWT in OIDC implicit flow CVSS 3.1CRITICAL 9.8
  • TI-2021-16566 Path Traversal in Archive Handling Leading to Code Execution CVSS 3.1HIGH 8.8
  • TI-2021-16567 Unsafe Deserialization of User Data Using XStream CVSS 3.1HIGH 8.8
  • TI-2026-22563 OpenOLAT: Server-Side Template Injection (SSTI) in Velocity templates allows Remote Code Execution CVSS 3.1HIGH 8.8
  • TI-2021-18077 Path Traversal in some REST methods leading to file upload to arbitrary places CVSS 3.1HIGH 8.1
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences