CVE-2018-11119: Ilias

Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days.

ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 redirects a logged-in user to a third-party site via the return_to_url parameter.

Affected products

• Ilias Ilias: from 5.1.0, up to and including 5.1.26; from 5.2.0, up to and including 5.2.15; from 5.3.0, up to and including 5.3.4; version 5.1.0 only; version 5.2.0 only

Published 2018-05-17. Last modified 2026-06-17.