Is CVE-2024-28198 actively exploited?

CVE-2024-28198 has no public evidence of in-the-wild exploitation as of 2025-04-10.

What is the CVSS score for CVE-2024-28198?

CVE-2024-28198 has a CVSS score of 4.6 (MEDIUM severity). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L.

How do I patch CVE-2024-28198?

Patch guidance is available from frentix security advisories. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2024-28198.

CVE-2024-28198 - remediation guidance & executive summary

Description

OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication. By manually manipulating http requests when using the draw.io integration it is possible to read arbitrary files as the configured system user and SSRF. The problem is fixed in version 18.1.6 and 18.2.2. It is advised to upgrade to the latest version of 18.1.x or 18.2.x. Users unable to upgrade may work around this issue by disabling the Draw.io module or the entire REST API which will secure the system.

CVSS Metrics

Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
Attack Vector: network
Complexity: high
Privileges: low
User Action: required
Scope: unchanged
Confidentiality: low
Integrity: low
Availability: low
Weaknesses: CWE-611 · XML External Entity (XXE)CWE-611 · XML External Entity (XXE)

Metadata

Primary Vendor: FRENTIX
Published: 3/11/2024
Last Modified: 4/10/2025
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

CVE-2024-28198

Description

CVSS Metrics

Metadata

Affected Products

Remediation Guidance

Executive Summary