CVE-2022-31266

MEDIUM

ILIAS < 7.10 - Unauthenticated Account Takeover via Email Change

Title source: llm

In ILIAS through 7.10, lack of verification when changing an email address (on the Profile Page) allows remote attackers to take over accounts.

Core 2

Core References

Not Applicable x_refsource_misc

Third Party Advisory x_refsource_misc

CVSS v3 4.3

EPSS 0.0074

EPSS Percentile 49.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CWE

CWE-306

Status published

Products (1)

ilias/ilias < 7.10

Published Jun 29, 2022

Tracked Since Feb 18, 2026