CVE-2020-36944: ILIAS Learning Management System 4.3

Record summary

CVE-2020-36944 has a selected CVSS score of 6.9 (medium); EIP currently links 1 catalogued exploit.

Description

ILIAS Learning Management System 4.3 contains a server-side request forgery vulnerability that allows attackers to read local files through portfolio PDF export functionality. Attackers can inject a script that uses XMLHttpRequest to retrieve local file contents when the portfolio is exported to PDF.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits: 1

CISA SSVC decision

ExploitationNone

AutomatableYes

Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 28, 2026 · Source: CVE List

Affected products and versions

Product	Source	Version range	Status
ILIAS Learning Management System Browse ilias.de / ILIAS Learning Management System	CVE List	4.3-5.1	affected

Proofs of concept

Catalogued exploits

ExploitDBILIAS Learning Management System 4.3 - SSRFExploitDB exploitby DotNot analyzed1 file

ExploitDB

PoC details

References

ILIAS GitHub Repositoryproduct

https://github.com/ILIAS-eLearning/ILIAS

nvd.nist.gov

https://nvd.nist.gov/vuln/detail/CVE-2020-36944

ExploitDB-49148exploit

https://www.exploit-db.com/exploits/49148

ILIAS Official Vendor Homepageproduct

https://www.ilias.de/

VulnCheck Advisory: ILIAS Learning Management System 4.3 - SSRFThird-party advisory

https://www.vulncheck.com/advisories/ilias-learning-management-system-ssrf