A vulnerability in Chamilo LMS allows unauthenticated remote attackers to compromise REST API keys due to predictable random number generation, posing a significant risk of unauthorized data access.

This vulnerability involves the use of insufficiently random values (CWE-330) during REST API key generation. An unauthenticated attacker can effectively brute-force these keys because the randomizing function uses a static range, making the output predictable based on the timestamp and user ID.

The ability to successfully brute-force REST API keys grants an attacker unauthorized access to sensitive data transmitted or managed through the Chamilo LMS API. Given the CVSS score of 7.5, this high-severity flaw could lead to data exfiltration and compromise of user information, directly impacting organizational privacy and regulatory compliance.

Immediate Action: Update Chamilo LMS to version 1.11.38 or 2.0.0-RC.3 immediately to implement the corrected random number generation logic.

Proactive Monitoring: Review API access logs for high volumes of authentication requests originating from single IP addresses or abnormal patterns associated with specific user accounts.

Compensating Controls: If immediate patching is not feasible, restrict access to the REST API endpoints via network-level controls or a Web Application Firewall to block suspicious brute-force attempts.

Public Exploit Available: Unknown

This vulnerability presents a clear risk to the integrity and confidentiality of the Chamilo LMS environment. Due to the ease of automation and the lack of required authentication, it is imperative that administrators prioritize updating to the patched versions. Failure to do so leaves the API exposed to trivial key discovery and subsequent unauthorized data access.