CVE-2024-28198 XML external entity (XXE) injection in OpenOLAT

What is CVE-2024-28198?

CVE-2024-28198 is a medium-severity vulnerability in OpenOLAT, published on 11 Mar 2024.

Official description

OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication. By manually manipulating http requests when using the draw.io integration it is possible to read arbitrary files as the configured system user and SSRF. The problem is fixed in version 18.1.6 and 18.2.2. It is advised to upgrade to the latest version of 18.1.x or 18.2.x. Users unable to upgrade may work around this issue by disabling the Draw.io module or the entire REST API which will secure the system.

Weakness: CWE-611

Which versions are affected by CVE-2024-28198?

It affects 1 product.

Products include Frentix Openolat.

How do I fix CVE-2024-28198?

No fix has been published for CVE-2024-28198 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-28198 being exploited?

There is no known exploitation of CVE-2024-28198 in the wild and no public exploit code.

Other vulnerabilities in OpenOLAT

• CVE-2026-31946 OpenOLAT: Authentication bypass via forged JWT in OIDC implicit flow Critical 9.8
• CVE-2026-28228 OpenOLAT: Server-Side Template Injection (SSTI) in Velocity templates allows Remote Code Execution High 8.8
• CVE-2021-39181 Unsafe Deserialization of User Data Using XStream High 8.8
• CVE-2021-41242 Path Traversal in some REST methods leading to file upload to arbitrary places High 8.1
• CVE-2021-39180 Path Traversal in Archive Handling Leading to Code Execution High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-pqvm-h9mg-434c.